Introducing Monad Skills: Build Normalization Transforms Without Pulling Your Hair Out

TL;DR: Monad has published three free AI agent Skills to help you build and validate log normalization transforms for OCSF, ECS, and CEF. Give your agent a vendor log format or sample records from a Monad pipeline, and the Skills guide it through creating a jq transform for your chosen schema. You still review and validate the result, but the mapping work becomes a review cycle instead of a largely manual exercise.

The normalization challenge

One of the hardest parts of information security is detection engineering — the rules and conditions that get written to fire alerts when something anomalous is happening in logs that a SIEM is monitoring. The reason this is so difficult is that every data source that’s emitting logs for the SIEM to ingest does so using their own schema. There is no one standard for logging that can be applied across all potential data sources in all industries. What security professionals wind up with is a dozen different logs that all label an IP address something different: s_ip, srcIP, ip_address, source_ip_address, etc.

The solution is to normalize those logs to a common information model style schema.  Which one works best may be determined by the types of data repositories or SIEMs employed, the capabilities of the detection engineers, or even the maturity of the companies involved.  There is no “One Right Schema to Rule Them All”.

However, it is widely accepted these days that picking one so detection engineers can write monitoring, detection, and alerting rules based off of a known schema that holds data where it’s expected to be makes them much easier to administer, maintain, and update over time (or will even allow them to migrate from one SIEM to another).

The hidden work of schema mapping

This presents another problem though: Who is responsible for analyzing the source data schema, performing the mapping to the chosen normalized schema, and then maintaining it whenever that data source decides to update their schema for whatever reason?

That’s often something that’s left to the detection engineers also, even when they lack the subject-matter expertise in the source system which would make mapping much easier. Even worse, some data sources don’t always emit the same schema — some fields are omitted from some sources when the value is null or empty, and some fields show up for work every day whether they’re carrying any data or not. This means that instead of analyzing one source record, sampling must be performed to try to capture all the edge cases of the source system’s schema, and that takes a lot of time.

Using AI to build transformations

Fortunately, modern LLMs seem almost purpose-built for that problem. They can monitor a stream of data for long periods of time without getting bored, distracted, or needing to do old-fashioned human things like sleeping. Being trained on an enormous corpus of text-based data, LLMs are wonderful at evaluating and analyzing text, reading instructions (such as schema reference documentation), and “translating” from one schema to another.

Normalize data in motion

At Monad, we think the best place to normalize data is in the pipeline, between its source and destination. Monad already supports these transformations; our hosted MCP server lets customers connect their preferred LLM to help build them.

Give your agent guardrails

LLMs are non-deterministic. “Build me a transform” shouldn’t mean “surprise me with a schema.” Skills give the agent a structured workflow, with explicit instructions for:

• Which tools to use and how to use them.
• What it must and must not do.
• Which assumptions it can and cannot make.
• How to validate that the result is correct.

The goal is more reliable results, not a free pass to skip human review.

Free Monad transform-building skills

We've published three free AI agent skills that help you build your own Monad transforms. Find them in the public community skills repository:

• ocsf-transform-builder
• ecs-transform-builder
• cef-transform-builder

What they can do

Give your AI coding agent a vendor's log format — or let an LLM sample records from an active pipeline through the Monad API or hosted MCP server — and it can write a jq transform and validate the result:

• OCSF: checked against a pinned schema version and the official schema.ocsf.io validator.
• ECS: field and categorization checks against the version you specify.
• CEF: structural validation of CEF:0 output.

All three use the same tested helper functions for timestamps, severity, IP checks, and other common tasks, keeping behavior consistent across transforms and Monad's jq engine (gojq).

How to use them

These skills work with any AI coding agent. If your agent supports SKILL.md skills, copy the skill folder into its skills directory; otherwise, provide the SKILL.md file as instructions. Follow the README setup steps — you’ll need jq, yq v4, git, and curl (CEF doesn’t need curl).

Optionally, connect the Monad hosted MCP server to pull live sample records and test transforms in a real pipeline. With it connected, it’s simple to ask your LLM:

“Please make a transform to take <input data source whatever> and turn it into OCSF v1.5.0.  Make sure these fields are always filled out: field1, field2, field3 as our detections rely upon them.  Sample data from my pipeline for the next 24 hours to make sure it’s as accurate as possible.” and then just check back in tomorrow.

Of course, always validate any work you have an LLM perform, but this takes literal HOURS of work off an engineer’s plate and turns it into a review cycle instead, while still getting all the benefits of normalization.

Contribute

If you build a transform that others could use, the skills will also walk you through contributing it to Monad’s community-transformations repository. Sharing transforms helps everyone build on one another’s work and helping each other is one of the best parts of infosec culture.

Questions or feedback? Let us know!

‍