Profile recommendations

tests/test_normalization.py

@@ -34,6 +34,16 @@ class NormalizationTests(unittest.TestCase):
         self.assertEqual(row["service"], "tcp")
         self.assertEqual(row["context"], "allowed outbound session")
 
+    def test_identity_and_event_aliases_populate_common_fields(self):
+        event = parse_log_line(
+            "winlog_event_data_targetusername=alice winlog_computer_name=host01 "
+            "winlog_event_id=4625 actor_id=bob"
+        )
+
+        self.assertEqual(event.fields["username"], "alice")
+        self.assertEqual(event.fields["hostname"], "host01")
+        self.assertEqual(event.fields["eventid"], "4625")
+
 
 if __name__ == "__main__":
     unittest.main()