Lab 02 — Cross-Platform Security Event Normalizer

Difficulty: 3/5 | Runs locally: yes

Pairs with the Phase 05 WARMUP Chapters 4, 8, 10 (telemetry across OSes) and foreshadows Phase 09 detection engineering.

Why This Lab Exists (Purpose & Goal)

You cannot detect, investigate, or correlate what you cannot read in a common form. Linux auditd, Windows Sysmon, and macOS unified logs describe the same kinds of events — a process started, a file was accessed, a logon failed — in wildly different formats. The goal of this lab is to build the normalizer that maps all of them into one schema, the foundation on which every detection and investigation downstream is built.

The Concept, In the Weeds

A normalized security event must preserve the facts an analyst and a detection rule need:

source_event · UTC time · host · user · process · action · result · evidence_id

Two design decisions carry the security weight:

  • UTC, always. Events arrive in different timezones and from clocks with drift. If you merge them naively, the causal order is wrong — you might conclude the effect preceded the cause (Phase 09's timeline lesson, in miniature). Normalizing to UTC is what makes correlation across sources sound.
  • Reject, don't invent. An event lacking identity or time must be rejected, not silently patched with a guessed default. A normalizer that invents fields produces confident, wrong conclusions — the worst kind. Preserving an evidence_id back to the raw source keeps the chain of custody (Phase 00) intact so any normalized claim can be traced to primary evidence.

The deeper point: normalization is where data quality becomes a security property. A detection is only as good as the field it keys on; if the normalizer drops or fabricates that field, the detection silently fails.

Why This Matters for Protecting the Company

Real environments are heterogeneous — Linux servers, Windows workstations and domain controllers, macOS laptops, cloud and Kubernetes audit logs. A SIEM that cannot normalize them into one schema cannot correlate an attack that moves across them (a phished laptop → a Windows credential → a Linux server). Normalization is the unglamorous foundation that makes cross-platform detection and incident response possible. When you can build a normalizer that preserves identity/time/process faithfully and refuses to invent data, you are building the substrate the whole detection program (Phase 09) stands on.

Build It

Implement the normalizer over synthetic Linux audit, Windows Sysmon, and macOS unified-log events: produce one schema preserving source event, UTC time, host, user, process, action, result, and evidence ID. Reject events lacking identity or time rather than inventing fields.

LAB_MODULE=solution pytest -q

Validation — What You Should Be Able to Do Now

  • Map each platform's native telemetry (auditd, Sysmon/ETW, unified log) to a common schema.
  • Explain why UTC normalization is required for correct correlation, and why inventing missing fields is dangerous.
  • Preserve an evidence ID back to the raw source so normalized claims remain traceable.

The Broader Perspective

This lab teaches that detection quality begins with data quality — long before any rule is written. The discipline of "preserve the real fields, reject the incomplete, never fabricate, keep a link to the source" is what separates an investigation that holds up from one that collapses under scrutiny. It is the same provenance discipline as Phase 00 evidence handling and the same "verify, don't assume" instinct as the binary-hardening lab. Carry it into Phase 09: when a detection misfires or an investigation stalls, the first suspect is almost always the telemetry — a missing source, an unnormalized field, a clock-skew error.

Interview Angle

  • "Compare ETW, auditd, and Endpoint Security." — All are the platform's kernel-level activity feed; they differ in richness, performance, and consumption. Normalizing them into one schema (with UTC and preserved identity) is what makes cross-platform detection and correlation possible.

Extension (Stretch)

Ingest real auditd/Sysmon/unified-log fixtures, add a source-health check that fires when a source goes silent, and feed the normalized stream into a Phase 09 detection.

References

  • Phase 05 WARMUP Chapters 4, 8, 10; Sigma rule project (portable detections).
  • Sysmon, auditd, macOS unified-log documentation; Phase 09 (detection engineering).