Normalization requires mapping proprietary vendor schemas to a common format at ingest. For example, you must map Akamai’s statusCode and Fastly’s status to a single unified field. This ensures that incident-time queries return consistent results across your entire delivery stack without requiring manual translation during an active outage.