Question

A security operations team is deploying a new SIEM. Logs are flowing in from firewalls, Windows servers, Linux hosts, and cloud services, each using different timestamp formats and field structures. Analysts complain that correlation rules fail because the same field (e.g., source IP) appears under different names across sources. Which SIEM processing capability must be properly configured to resolve this issue?

Accepted Answer

Normalization, which maps disparate log fields into a common schema

Answer

Aggregation, which reduces duplicate events into summarized counts

Answer

Retention policy, which defines how long raw logs are stored

Answer

Alert throttling, which limits the number of notifications per rule