Glossary: Security Monitoring and Automation

normalization

Also written: normalize, normalizes, time normalization

Giving the same field the same name and format in every source, so one rule can search them all. For example, the web log's client address and the sign-in message's "from" both become `ip`, and every time becomes UTC.