Because log data within an environment varies widely, Helix Enterprise imposes a high-level standardized view of events and normalizes the data. This allows you to craft queries and to interact with the data in a more predictable, standardized way, such as searching and creating rules.
The Helix Enterprise taxonomy serves as the “dictionary” for the Helix Enterprise parsers that normalize the event data. Helix Enterprise parses event data so that it is more easily compared and available to use as a pivot in searches.
This section covers the following topics: