Normalization in CIM aligns differing field names that represent the same type of data across multiple sources.
Extract:“Field aliases and tags are used to map fields with different names but equivalent meaning, such as source_ip and src_ip.”
Thus, src_ip and source_ip should be normalized to represent a common standardized field.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit