What is normalised log data?¶

Normalised log data is information from different systems converted into a common structure so it can be searched and compared more easily.

A security platform might map different vendor fields into standard labels such as source address, user, action, result and device.

Avoid this assumption: That normalisation preserves every detail and every nuance of the original event. It may not.

Normalisation is useful because different systems describe similar activity in different ways. One product may use “src_ip”, another “clientAddress” and another “origin”. Mapping them to a common field makes analysis faster.

But the mapping process involves interpretation. A source field may not have an exact equivalent. Several source values may be grouped into one normalised category. Some original fields may be discarded, shortened or left unmapped.

A normalised event may therefore be easier to read but less precise. An action labelled “login success” in a common schema may hide whether the source event represented primary authentication, token refresh or session continuation.

Investigators should identify the platform that performed the normalisation and obtain the original source event where important. Ask for the field mapping, parser version and any transformation rules applied.

Preserve both the normalised record and the raw source if available. Use the normalised data to identify patterns and relevant events, but use the source record to support detailed interpretation.

Where different systems are compared, ensure apparently matching fields really represent the same thing. A common label does not guarantee common meaning.

Operational takeaway¶

Normalised log data makes different sources easier to compare, but investigators must check the original fields and mapping rules before relying on the normalised meaning.