Without it, a rule for failed authentication has to know Windows calls it 4625, sshd says Failed password, FortiGate has its own wording, Azure has another. With it you write "authentication failure" once.
Cost is real though. Every new source needs mapping and the mapping is where the bugs live. Worth it if you write detections, not worth it if you mostly search, because search does not care about schemas.
the other cost nobody mentions is that when the normalisation is wrong you cannot tell, because the original line is not what you are looking at anymore. keep the raw
You get to write one detection instead of six.
Without it, a rule for failed authentication has to know Windows calls it 4625, sshd says Failed password, FortiGate has its own wording, Azure has another. With it you write "authentication failure" once.
Cost is real though. Every new source needs mapping and the mapping is where the bugs live. Worth it if you write detections, not worth it if you mostly search, because search does not care about schemas.