From 87eeba4cf4e91fd8598e1fb233ecc9452b1c3dbb Mon Sep 17 00:00:00 2001 From: bnartiff <100230783+bnartiff@users.noreply.github.com> Date: Tue, 16 Sep 2025 15:12:48 -0400 Subject: [PATCH] Update username-and-hostname-normalization.md Typo --- docs/cse/schema/username-and-hostname-normalization.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/cse/schema/username-and-hostname-normalization.md b/docs/cse/schema/username-and-hostname-normalization.md index 0a8f262f53..fb65bddb9c 100644 --- a/docs/cse/schema/username-and-hostname-normalization.md +++ b/docs/cse/schema/username-and-hostname-normalization.md @@ -44,7 +44,7 @@ The following fields of the schema are normalized. | `srcDevice_hostname` | hostname | | `user_username` | username | -When a username is normalized, the original, un-normalized name is placed in a `_raw` name attribute, for example,  `user_useraname_raw`. The normalized name is placed in the attribute field `user_username`. The rules engine allows the `_raw` username forms to be used in rule creation. +When a username is normalized, the original, un-normalized name is placed in a `_raw` name attribute, for example,  `user_username_raw`. The normalized name is placed in the attribute field `user_username`. The rules engine allows the `_raw` username forms to be used in rule creation. If a name normalization configuration exists, the name attribute will be populated with the form `:` where the `` portion is not populated for the normalized default domain.  When name normalization is enabled all name fields (not-raw) will be lowercase. For more information, see [Single domain example](#single-domain-example) and [Multiple domains example](#multiple-domains-example) below. @@ -182,4 +182,4 @@ Following is an example configuration for a case where the customer has a domain ## Additional resources -Blog: [What’s going on? The power of normalization in Cloud SIEM](https://www.sumologic.com/blog/whats-going-on-normalization-cloud-siem) \ No newline at end of file +Blog: [What’s going on? The power of normalization in Cloud SIEM](https://www.sumologic.com/blog/whats-going-on-normalization-cloud-siem)