Profile recommendations

src/fgai/detectors.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from .logs import THREAT_ACTIONS
 from .models import LogEvent
+from .normalization import canonical_value
 
 
 DETECTOR_MINIMUMS = {
@@ -14,7 +15,7 @@ DETECTOR_MINIMUMS = {
 def event_detector_categories(event: LogEvent) -> tuple[str, ...]:
     fields = event.fields
     action = event.action
-    event_id = fields.get("eventid", fields.get("event_id", fields.get("winlog_event_id", "")))
+    event_id = canonical_value(fields, "eventid")
     categories: list[str] = []
     if action in {"fail", "failed", "failure", "login_failed", "logon_failed", "authentication_failed"} or event_id == "4625":
         categories.append("auth_failure")