## Making Sense of Chaos: Normalization & Parsing

Imagine trying to read a book where every sentence is written in a different language. That is what raw logs look like to a computer.

**Raw Log Example 1 (Cisco ASA Firewall):**
`Oct 27 10:00:01 firewall-01 %ASA-6-302013: Built inbound TCP connection 1234 for outside:192.168.1.10/4444 (192.168.1.10/4444) to dmz:10.0.0.5/80 (10.0.0.5/80)`

**Raw Log Example 2 (Apache Web Server):**
`192.168.1.10 - - [27/Oct/2023:10:00:01 +0000] "GET /index.html HTTP/1.1" 200 2326`

**Raw Log Example 3 (Windows Event 4624):**
`Logon Type: 3, Source Network Address: 192.168.1.10, Account Name: Guest`

A human can look at these and deduce that `192.168.1.10` is the "Source IP" in all three cases. But a computer cannot. If you search for `src_ip=192.168.1.10`, the computer won't find anything unless the logs are **Parsed** and **Normalized**.

### The Parsing Process
Parsing is the act of breaking a raw text string into structured fields using logic (often Regular Expressions or "Regex").

**Parsing the Apache Log:**
*   Raw: `192.168.1.10 - - ...`
*   Regex Rule: `^(S+) S+ S+ [([w:/]+s[+-]d{4})] "(S+)s?(S+)?s?(S+)?" (d{3}|-) (d+|-)`
*   **Extracted Fields**:
    *   client_ip: `192.168.1.10`
    *   timestamp: `27/Oct/2023...`
    *   method: `GET`
    *   url: `/index.html`
    *   status_code: `200`

Now the SIEM understands the data.

### Normalization: The Rosetta Stone
Parsing extracts the data, but **Normalization** standardizes the *names* of the fields.
*   Vendor A calls it: `source_address`
*   Vendor B calls it: `src_ip`
*   Vendor C calls it: `ClientIP`
*   Vendor D calls it: `c_ip`

If you are hunting for an IP, you don't want to run 4 different queries (`source_address=X OR src_ip=X OR...`).
Normalization maps ALL of these to a single **Common Information Model (CIM)** field, usually `src_ip` or `source.ip`.

### Why This Matters for Analysts
1.  **Field Extraction Errors**: Sometimes parsing fails. If a developer changes the log format of an app, the SIEM might stop extracting the username. You will see the raw log, but searches for `user="baris"` will return 0 results. This is a common troubleshooting task for analysts.
2.  **Performance**: Searching based on indexed fields (`src_ip=1.2.3.4`) is milliseconds fast. Searching raw text (`"1.2.3.4"`) is essentially doing `Ctrl+F` on terabytes of text—it is agonizingly slow.
3.  **Visualizations**: You cannot build a chart of "Top 10 Bad IPs" if the IP address isn't extracted into a field.

### Common Schemas
*   **Splunk CIM (Common Information Model)**: The standard for Splunk.
*   **ECS (Elastic Common Schema)**: The standard for ELK/Elastic.
*   **OCSF (Open Cybersecurity Schema Framework)**: An emerging open standard backed by AWS, Splunk, and IBM to unify log formats across the industry.

### Scenario
An attacker uses a custom tool that generates logs in a format your SIEM hasn't seen before.
*   **Bad Analyst**: Ignores it because it doesn't show up in dashboards.
*   **Good Analyst**: Notices the raw logs, writes a custom Regex parser to extract the `Command_Line` field, and creates a new alert for it.