Adopting a common event schema without retiring your detections

The payoff

When a network connection event looks the same regardless of whether a firewall, a cloud flow log, or an endpoint agent produced it, everything downstream gets simpler. Rules are written once and cover every source. Analytics tools stop needing per-vendor adapters. AI systems reason over consistent structure instead of guessing at what a field means. Public schemas such as OCSF and ECS exist for exactly this reason.

The risk

Your detection library was written against the field names you have today. Renaming them wholesale breaks rules silently, and a broken rule looks identical to a rule that simply has nothing to report.

Decide where normalization lives

If the mapping happens inside the analytics platform at search time, only that platform benefits and every rule still depends on native names. If it happens in CyberAIX Pipeline, every destination receives the same shape and the schema is genuinely shared. The second option is the only one where the payoff is real.

A transition that keeps rules working

Emit both names for a while. Configure the pipeline to carry the native field and its canonical equivalent side by side. Existing rules keep working. New rules use the canonical name from day one.

Inventory what each rule reads. Parse the rulebook and extract every field reference. Group by native field so you know exactly what breaks if a given name disappears.

Translate in order of dependency. Rules that touch the fewest native fields go first. Each translated rule is replayed against a captured window of real events and must produce the same hit counts as the original before it goes live.

Watch for orphans. As native fields are retired, run a scheduled check for rules still referencing them. Zero hits is not a health signal.

Retire the duplicate per field. Once no live rule reads a native name, stop emitting it. Storage shrinks and the schema becomes canonical in fact, not just in intent.

The fields that do not fit

No public schema has a perfect home for every vendor-specific field. Use the schema's designated overflow area, and treat every entry there as a backlog item. Review it monthly. Fields that stay unmapped for two quarters and are never queried should be dropped at the pipeline.

The end state

A rule for "unusual outbound connection" that works against every source capable of producing a network event, including sources you have not onboarded yet. A new firewall vendor becomes a mapping exercise at the pipeline, and every existing rule covers it on the first day.