Normalizing Log Formats Simplifies SOC Detection Rules

A developer built triagelens, a SOC triage tool that normalizes four log formats (Windows Security, Sysmon, SSH auth.log, and JSON) into a single interface. This allows detection rules to ignore source format and focus on fields like process name or command line. The approach eliminates messy format-specific branches in every rule, making the system scalable and easier to test.