Log Normalization The Art of Providing Detection Ready Data Szilárd Parrag

Logs are critical for detection and analytics, but they're written by application developers, not detection engineers. The result: countless formats, inconsistent fields, and an impossible task of correlation without normalization. In this talk, we'll explore how normalization brings order to chaos: from standards like OpenTelemetry semantic conventions, ECS, and OCSF, to practical considerations like storage optimization, depth vs. flat models, and extensibility. We'll discuss where normalization should happen, at ingestion, in the pipeline, or in the SIEM. Using real-world examples, we'll show how normalized data unlocks analytics, cross-source correlation, and even derived metrics. Let's make logs usable by design, not by afterthought!