it engineer - security log normalisation.

ABN AMRO wants to scale out the usage of logging by normalising raw logging to a normalised schema. The normalisation is done using Microsoft tooling as part of the Azure landscape using a manual process. The normalization configuration needs to be placed within the Azure Monitor data pipeline and requires identification of fields and values, next to transformation to be done using KQL and Regex concepts. These need to be generated based-on a small sample of logging and applied directly within the data pipeline.

With the following results:

• At least 60% of the security log schema’s identified for 150 application are normalised by EOY
  • Testing the security log normalization
  • Applying of the configuration in the pipeline
  • Validation of the security log normalisation with the relevant stakeholders
  • Ensuring data quality over-time including preventing dropping of security logs