Which component normalizes events?

Question

Options

• ASA-CIM.
• BSA-Notable.
• CES application.
• DTechnology add-on.

• A
  4% (2)
• B
  2% (1)
• D
  93% (43)

Explanation

Technology Add-ons (TAs) are purpose-built to normalize raw, vendor-specific events into a common format by extracting fields, applying event types, and mapping data to the Common Information Model (CIM). Each TA handles a specific data source (e.g., Palo Alto firewalls, Windows logs) and does the heavy lifting of field extraction and tagging before data reaches the ES layer.

SA-CIM (A) is wrong because it defines the CIM schema and data models - it's the standard TAs normalize to, not the component doing the normalizing. SA-Notable (B) is wrong because it manages notable events (alerts/incidents) within ES, not raw log normalization. The ES application (C) is wrong because it's the overarching security analytics platform - it consumes already-normalized data to power dashboards, correlations, and investigations.

Memory tip: Think of the pipeline as a factory assembly line - raw logs enter via Technology Add-ons ("Translators and Adapt-ors"), get normalized to CIM, then ES does analysis on clean data. TA = the data prep step, everything else = what happens after.

No community discussion yet for this question.