A company sends logs from its cloud management plane, web application firewall, guest operating systems and several SaaS applications to one platform. Each source uses different field names, formats and time zones, so analysts cannot link related events into a single attack sequence. Which SIEM capability addresses this?

A SIEM parses incoming events and maps them into a common schema, so a user name, source address, action and timestamp mean the same thing regardless of which product produced the record; timestamps are typically converted to a single reference such as UTC. Once data is normalized, correlation rules and analytics can join events from different sources, for example a suspicious login in the identity logs, a permission change in the management plane and a data download from object storage, into one incident. Retention tiering controls how long and where events are kept, which affects cost and investigation depth but does nothing to make heterogeneous fields comparable. Hashing log files supports integrity and chain of custody by revealing alteration, yet a hashed log with inconsistent fields is just as hard to correlate. Compression and deduplication reduce storage and licensing volume but leave formats and time references unchanged. Exam caveat: normalization quality depends on accurate parsers and synchronized time sources; clock drift across systems can break correlation even after parsing. Operational check: confirm every source has a working parser, that key fields such as identity, address and time are populated consistently, and that a correlation rule spanning at least two sources fires in testing.