triagelens is a little soc triage tool i've been building. you paste in raw logs, it runs rule-based detections, maps them to mitre att&ck, scores the risk 0-100, and writes an analyst-style report. the part that almost sank the whole thing wasn't the detections. it was the logs.
the problem
it takes four formats: windows security event 4688, sysmon event id 1, linux ssh auth.log, and generic json. sounds fine until you actually look at them.
a "process started" event exists in three of those four. in windows security 4688 it's a structured event with a new process name field and a creator process. in sysmon event 1 it's also structured but the fields sit in different places with different names, plus you get a command line and hashes windows security doesn't give you. in auth.log there's no such thing as event 1, it's a plain sentence like Failed password for root from 203.0.113.9 port 41822 ssh2. no event id, no fields, just text.
my first pass had the detection rules reach straight into the parsed log. so a rule for suspicious process spawns had a branch for "if it came from sysmon look here, if it came from windows security look there." every new rule inherited that mess. add a fourth format and you're editing every rule again. that doesn't scale and it's miserable to test.
