Just built a KQL function to normalize hostnames across different log sources

Just spent the last two hours cleaning up a recurring alert noise issue. Root cause: inconsistent hostname formats between Windows Security Events, Sysmon, and our custom app logs. One source uses FQDN, another uses just the hostname, and another had a mix of upper and lowercase.

Built a reusable KQL function to normalize them all. This ensures join operations and watchlists actually work. Posting it here because I've seen this trip up at least three different deployments I've been called into.

```kql
.create-or-alter function Normalize-Hostname {
(rawHostname:string) {
tostring(rawHostname)
| extend trimmed = trim(@'[@\]$', @' ') // Removes trailing domain slashes and spaces
| extend lowercased = tolower(trimmed)
| extend normalized = iff(lowercased matches regex @'^[a-z0-9\-]+$', lowercased, // simple hostname
iff(lowercased contains '.', split(lowercased, '.')[0], // strip domain
lowercased)) // fallback
| project result = iff(isempty(normalized) or isempty(rawHostname), rawHostname, normalized)
}
}
```

**Usage in a query:**
```kql
SecurityEvent
| where EventID == 4625
| extend NormalizedComputer = Normalize-Hostname(Computer)
| join kind=inner (Heartbeat | extend NormalizedComputer = Normalize-Hostname(Computer)) on NormalizedComputer
```

**Key points:**
* Handles FQDN stripping, case normalization, and trims common garbage characters.
* Falls back to the original input if the result would be empty, preventing data loss.
* Registered as a function in Sentinel, so it's available across all workspaces and queries.

If you've got other log sources with weird hostname formats (looking at you, legacy Apache logs), you might need to extend the regex. What other variations have you all had to account for?

-shift