Developer builds unified log normalizer to simplify SOC threat detection rules

A developer building TriageLens, a security operations triage tool, found that handling four different log formats — Windows Security Event 4688, Sysmon Event ID 1, Linux SSH auth.log, and generic JSON — was breaking detection rule scalability. Each format represented similar events like process starts differently, forcing detection rules to branch by format and making every new rule harder to maintain. To fix this, the developer designed a single normalized data interface called NormalizedEvent, with four dedicated parsers that each translate their raw format into the same common shape. Detection rules now only read from this unified structure, never touching the original raw data, which keeps the abstraction clean and format-agnostic. The approach also simplified testing by separating parser tests from rule tests, with neither needing to load real logs from multiple formats.