Is the raw log preserved?
Yes. Normalization does not delete the raw log; it adds searchable and reportable fields.
Platform
Syslog normalization platform
Syslog normalization maps different device field names into one shared dictionary so the same source IP or user has the same meaning everywhere.
Example normalized event
{
"event.kind": "event",
"event.category": "network",
"source.ip": "198.51.100.24",
"destination.ip": "10.10.4.20",
"observer.vendor": "fortinet",
"bivoxy.normalized": true
}Why one dictionary?
A shared dictionary prevents dashboards, AI reports, alerts, and APIs from calculating the same value differently.