A transit SOC standardizes case schemas so different SOAR tools still feed one metrics lake. What platform pattern is that?

A transit SOC that standardizes case schemas so different SOAR tools still feed one metrics lake is normalizing case data for municipal reporting. Field names, severities, timestamps, and outcome codes become consistent even when bus, rail, and corporate SOCs use different products. Normalized schemas let citywide MTTR, false-positive rates, and automation coverage roll up without manual spreadsheet reconciliation across incompatible exports.

Why the other options fail by concept: Federating SOAR case data schemas for unified console access to one municipal metrics lake leaves separate schemas behind a common access view, not case schema alignment, so it does not resolve inconsistent field names, severities, timestamps, or outcome codes needed for one metrics lake. Replicating raw SOAR case payloads to one municipal metrics lake before schema normalization moves raw case data without aligning case schemas, so the metrics lake still cannot roll up comparable transit incident fields. Syncing SOAR case status updates across tools for joint municipal metrics lake reporting shares only status values, not case data schemas, so it leaves field-level inconsistency in place and prevents unified metrics reporting.

Exam caveat: Schema normalization requires governance—tools will still have vendor-specific extensions, so define a required core set and map extensions carefully. Operational check: publish a municipal case schema, map each SOAR export to it, validate sample incidents land in the metrics lake with required fields, and reject pipelines that omit core civic IR fields.