A security operations team wants to reduce noise in their SIEM by implementing log source normalization. What does normalization accomplish?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because different vendors use different field names for the same concepts (e.g., 'src_ip', 'source_address', 'SourceIP' all mean the same thing); normalization maps these to a consistent Common Information Model (CIM) or similar schema so a single correlation rule works across firewall, IDS, and endpoint logs simultaneously. A is wrong because normalization is about data schema transformation, not encryption; encryption is a separate storage security concern.
Full explanation below image
Full Explanation
B is correct because different vendors use different field names for the same concepts (e.g., 'src_ip', 'source_address', 'SourceIP' all mean the same thing); normalization maps these to a consistent Common Information Model (CIM) or similar schema so a single correlation rule works across firewall, IDS, and endpoint logs simultaneously. A is wrong because normalization is about data schema transformation, not encryption; encryption is a separate storage security concern. C is wrong because normalization may or may not affect storage size; its purpose is field consistency, not compression. D is wrong because normalization transforms data format; filtering is a separate process that may be applied independently.