Data normalization is the process of converting records from many sources into one consistent structure so they can be counted together. It is unglamorous, it is where most of the implementation effort in a measurement programme goes, and the decisions made during it silently determine what the resulting metrics mean.
Field mapping is the easy one. Source field to canonical field, mostly mechanical.
Value mapping is harder. One scanner rates findings on five severity levels, another on four, a third on a numeric score. Collapsing them into a common scale is a judgement, and every metric that filters on severity inherits it.
Identity resolution is harder still. The same server appears in the CMDB by hostname, in the EDR console by agent ID, in the cloud provider by instance ID, and in the vulnerability scanner by IP address. Deciding these are one asset, correctly, is most of the work. Getting it wrong inflates or deflates every asset-based denominator you have.
Temporal alignment is the one people forget. Sources report at different frequencies with different lags, some in local time, some in UTC. A daily metric assembled from a source that updates weekly is not a daily metric.
Severity collapse. A four-into-three mapping decided once by an engineer becomes the basis of every risk-weighted metric in the programme, and is almost never revisited.
Over-eager deduplication. Merging two records that were actually different assets removes a real exposure from the count.
Under-eager deduplication. Treating one asset as three inflates the denominator and makes coverage look worse than it is, which is at least the safer error.
Silent dropping. Records that fail to map cleanly get discarded rather than quarantined, so the metric is computed over the subset that happened to fit.
That last one causes more trouble than the rest combined, because it is invisible. Track the count of records that failed to normalize as its own series, and review it.
Normalize for computation, retain the original for investigation. Store the record as it arrived alongside its canonical projection.
The moment you only keep the normalized form, every normalization decision becomes permanent and unauditable, and correcting one means losing the history that preceded the correction.
From the blog