Abstract: A system and a method for adjusting an order of parsing rules for routing incoming security logs to log normalization routines that are used for processing large volumes of security incident event data are provided. The method includes: sequentially applying, in a first order, a set of parsing rules to each of a first set of logs to determine destinations that correspond to log normalization routines for reformatting into a common format; determining whether an efficiency of the application of the parsing rules would be increased by reordering into a second order; and reordering the set of parsing rules into the second order based on the determination, so that the parsing rules will be sequentially applied to the next set of logs based on the second order thereof. The efficiency determination is based on volumes and complexities of various log types.

Abstract: A system and a method for adjusting an order of parsing rules for routing incoming security logs to log normalization routines that are used for processing large volumes of security incident event data are provided. The method includes: sequentially applying, in a first order, a set of parsing rules to each of a first set of logs to determine destinations that correspond to log normalization routines for reformatting into a common format; determining whether an efficiency of the application of the parsing rules would be increased by reordering into a second order; and reordering the set of parsing rules into the second order based on the determination, so that the parsing rules will be sequentially applied to the next set of logs based on the second order thereof. The efficiency determination is based on volumes and complexities of various log types.