MCP sample fetch now asks for common Winlogbeat/ECS fields before

tests/test_normalization.py

@@ -44,6 +44,22 @@ class NormalizationTests(unittest.TestCase):
         self.assertEqual(event.fields["hostname"], "host01")
         self.assertEqual(event.fields["eventid"], "4625")
 
+    def test_winlogbeat_ecs_aliases_populate_common_fields(self):
+        event = parse_log_line(
+            "@timestamp=2026-06-30T10:00:00Z event.code=4625 event.action=logon-failed "
+            "event.outcome=failure log.level=warning user.name=alice host.name=win01 "
+            "source.ip=10.0.0.5 winlog.channel=Security winlog.provider_name=Microsoft-Windows-Security-Auditing "
+            "winlog.event_data.LogonType=3 process.name=lsass.exe"
+        )
+
+        self.assertEqual(event.fields["eventtime"], "2026-06-30T10:00:00Z")
+        self.assertEqual(event.fields["eventid"], "4625")
+        self.assertEqual(event.fields["action"], "logon-failed")
+        self.assertEqual(event.fields["severity"], "warning")
+        self.assertEqual(event.fields["username"], "alice")
+        self.assertEqual(event.fields["hostname"], "win01")
+        self.assertEqual(event.fields["srcip"], "10.0.0.5")
+
 
 if __name__ == "__main__":
     unittest.main()