The original title is about normalizing four log formats into one shape for detection rules. Let me rewrite this as a punchy headline.

Short summary

The author details how they normalized four log formats (Windows Security 4688, Sysmon Event 1, Linux SSH auth.log, generic JSON) into a single NormalizedEvent interface for a SOC triage tool called triagelens. Each parser fills the same interface, so detection rules never need to know which format an event came from. The post includes a real detection rule for encoded PowerShell and explains how the abstraction simplifies both rule logic and testing.

• •Four log formats normalized into one NormalizedEvent interface with parsers per format
• •Detection rules read only normalized fields, never raw source data, preventing format-specific branches
• •Parser and rule tests are cleanly separated; rule tests use synthetic events without loading real logs

Generated with AI, which can make mistakes.