Why is log normalization important in a SIEM system?

• A. To ensure logs can be compared and correlated across disparate sources
• B. To encrypt logs for transport
• C. To delete duplicates to save storage
• D. To increase log verbosity

Answer: (A)

Log normalization standardizes diverse logs into a uniform schema with common field names, formats, and time representations. This lets logs from different sources be compared and correlated because the SIEM can map each vendor’s fields into the same model, such as user, source IP, destination, timestamp, and event type. With a unified format, detection rules can be written once and applied across all data, searches become reliable, and timelines align when timestamps are normalized to a common timezone (often UTC). This improves detection accuracy, reduces parsing errors, and enables meaningful dashboards and investigations. Encrypting logs for transport, deduplicating for storage, or simply increasing verbosity are separate concerns not achieved by normalization.