Systems and methods for automatically creating normalized security events in a cybersecurity threat detection and mitigation platform

Abstract

A system, method, and computer-program product includes obtaining raw event data associated with a subscriber, automatically selecting an automated event ingestion instruction of a plurality of distinct automated event ingestion instructions for processing the raw event data, automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing the automated event ingestion instruction, automatically transforming the pre-normalized security event to at least one normalized security event, automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event, generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions, and executing a threat mitigation response that mitigates a security threat associated with the security alert.