Normalization: The Common Schema
One language for every vendor, or three queries for one IP.
Key takeaways
- The same source IP arrives as src_ip, SourceAddress, and sourceIPAddress from different vendors.
- Adopt a standard schema: Elastic Common Schema (ECS), Splunk CIM, or the vendor-agnostic OCSF.
- Map fields to the schema before they are written to disk.
- Rules written against the schema survive a vendor swap — your detections do not break.
If a Palo Alto firewall calls an IP src_ip, a Windows event calls it SourceAddress, and AWS calls it sourceIPAddress, your analysts must write three different queries to track one IP. Normalization translates disparate vendor terminologies into a single, unified language.
- Best practice. Adopt a standardized schema like Elastic Common Schema (ECS), Splunk Common Information Model (CIM), or the emerging vendor-agnostic Open Cybersecurity Schema Framework (OCSF).
- Implementation. Map all parsed fields to the schema before they are written to disk. In OCSF, src_ip, SourceAddress and sourceIPAddress all become src_endpoint.ip.
- Why it matters. All detection rules and SOAR playbooks are written against the normalized schema fields. This ensures that if you swap out your firewall vendor tomorrow, your detection rules do not break.
Normalization is the contract between your data pipeline and everything downstream — detections, dashboards, and automation all depend on it holding.
Keep reading — it's free
Register once to unlock every lesson in the Vijilan Cybersecurity Academy, track your progress, and earn domain badges toward the certification. No cost, no sales pitch.
- Every lesson, free
- Progress tracking
- Domain badges
- No credit card