thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Log Normalization

Converting logs from different formats into a common schema so they can be correlated and searched consistently.

Definition

Different products name the same field differently (src_ip, SourceAddress, client.ip). Normalization maps fields to a common data model such as Splunk CIM, Elastic Common Schema, OCSF or Google UDM. It enables vendor-agnostic detections.

Example

Mapping Palo Alto "src" and Windows "IpAddress" both to a common source IP field.

Exam tip

Normalization is required before effective correlation across different log sources.

Related terms