SIH26156/Blockchain & Cybersecurity

Universal network log normalization framework

A software framework that ingests logs from any network device, normalizes them into a unified schema without losing raw data, and prepares them for SIEM platforms.

National Technical Research Organisation (NTRO) · Software

Teams already in: Not read yet
Buildable in 36 hours: ModerateOur estimate, from their wording
Hard blockers: NoneNothing you must source first
Submissions close: 15 Sept9 days left

Make this one of our two Compare with others

Signing in saves it for your whole team — everyone on your invite link sees the same two entries. Anything you shortlisted while signed out comes with you.

Submit on sih.gov.in Briefing video

Whether this suits your team

Why this fits you

This organisation declared winners on 13 problem statement(s) in SIH 2025 and on 13 in SIH 2024. It has awarded 4 joint winner(s), so it sometimes splits a prize between two teams.

What you would have to build

Decomposed from what the description asks for. Nothing added.

01
Raw Event Ingestion
Ingests massive volumes of logs from diverse sources while preserving complete raw data without information loss.
02
Parsing and Normalization
Extracts source-specific attributes and maps fields into a common event taxonomy and unified schema.
03
Plug-and-Play Onboarding
Allows easy onboarding of new log sources and vendor formats through an extensible architecture.
04
Traceability and Storage
Maintains traceability between the normalized events and the original raw data for forensic purposes.
05
Containerized Deployment
Packages the framework into containers to make it platform-independent and suitable for air-gapped networks.

What they ask for, and what they leave open

Both columns are read off the brief's own wording. Nothing here is inferred from the ministry's name.

They state

The jury will check whether the framework can handle diverse log formats, preserve raw data while normalizing fields, deploy in an air-gapped network, and run inside containers.

They never say

exact throughput requirements in events per second
specific target unified schema or taxonomy to be used
supported container orchestration tools

A jury can still ask about these. Decide them deliberately rather than by accident.

What they'll ask you

Generated from the brief's own wording and the competition's published rules — never from a guess about what this ministry prefers.

Exact throughput requirements in events per second?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Specific target unified schema or taxonomy to be used?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Supported container orchestration tools?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.

10 more— the ones a panel gets to if there is time

Has any part of this been shown at a previous event, hackathon or college project?
The guidelines are explicit: your solution must not have appeared in any previous event or programme, of any sort. A recycled project is what a team under time pressure reaches for.

The data

What the organisers attached, and what the brief assumes you can get.

Dataset from the organisers: None attached
Does the brief need data?: Nothing in the text says it depends on a dataset we would have to find.
Briefing video: Published by the organisers

Also from National Technical Research Organisation (NTRO)

Same organisation, same year. Reading two of theirs tells you more about what they care about than reading one.

Take this to an AI

Pick what you are about to do and copy the prompt. It carries the organisers' own wording, the constraints they never spell out, and an instruction not to invent requirements they never set.

Who has this problem, what already exists, and what you would have to find out.

# Context: India's Smart India Hackathon 2026

I am on a student team entering SIH 2026. Problem statement SIH26156, set by National Technical Research Organisation (NTRO).
Its official title, word for word: "Universal Log Pre-processing Framework"
Theme: Blockchain & Cybersecurity. Category: software.

In plain terms: A software framework that ingests logs from any network device, normalizes them into a unified schema without losing raw data, and prepares them for SIEM platforms.

## The organisers' full description, verbatim

• Background Modern enterprises generate massive volumes of logs from a wide range of sources, including network devices, servers, operating systems, applications, databases, cloud services, containers, endpoint security tools, identity and access management systems, IoT devices, and other hardware and software platforms. These logs are produced in diverse formats such as Syslog, JSON, XML, CSV, CEF, LEEF, proprietary vendor formats, and application-specific schemas. The diversity of log structures creates significant challenges in centralized monitoring, security operations, compliance reporting, incident investigation, and threat analytics. Security teams often spend substantial effort developing source-specific parsers and normalization rules before the data can be effectively utilized by SIEM, data lake, or machine learning platforms. As organizations adopt hybrid, multi-cloud, and AI-driven environments, the need for a universal and extensible log standard that can accommodate both current and future data sources have become increasingly critical. • Detailed Description Design and develop a Universal Log Pre-processing Framework (ULPF) capable of ingesting, parsing, normalizing, and standardizing logs and events generated by any hardware or software system. The framework should support diverse event sources while preserving the original event data for forensic and compliance purposes. It should transform heterogeneous logs into a unified schema that enables consistent analytics, correlation, visualization, threat hunting, anomaly detection, and machine learning applications. The framework must be scalable, extensible, vendor-agnostic, and suitable for deployment in Big Data environments handling billions of events per day. • Expected Solutions This solution should cover universal event schema and processing framework that enables: a) Preserve complete raw event data without information loss. b) Extract and parse source-specific attributes. c) Normalize fields into a common event taxonomy. d) Maintain traceability between normalized and original events. e) Plug-and-play on boarding of new log sources. f) Unified visibility across enterprise environments. g) Efficient SIEM and Data Lake integration. h) AI/ML-ready security and operational analytics. i) Reduced parser development effort. j) The solution shall be deployable in an air-gapped network. k) Solution may be packaged in a container for making it platform independent. • Current Scope Build a framework that converts any perimeter network device-generated log or eventâ€”regardless of source, format, vendor, or technology into a standardized, lossless, analytics-ready representation for next-generation SIEM and cybersecurity platforms. • Expected Solution/Deliverables for Evaluation • Source Code Link (GitHub/Drive Link) • Readme with Setup Instructions • Architecture Document (Max 2 Pages) • Demo Video (Max 2 Minutes) • Technical Presentation (Max 5 Slides)

## What the brief never says

- exact throughput requirements in events per second
- specific target unified schema or taxonomy to be used
- supported container orchestration tools
## Constraints that are not negotiable

- The judged build is a prototype demonstrated in roughly 36 hours by students, not a product.
- A jury evaluates it against this problem statement's own wording, not against general merit.
- We submit on sih.gov.in; the problem statement number and title above must match exactly.
- Your solution must not have appeared in any previous event or programme, of any sort.

## What I want from you

1. Who actually has this problem in India, and what they do about it today.
2. What already exists — government systems, open-source projects, published research — that we should not rebuild.
3. For each item under 'what the brief never says', what the realistic answer is likely to be and how I could verify it.
4. The two or three things about this domain that a student team would get wrong without local knowledge.
## How to answer

- Everything above between quotation marks is the organisers' own wording. Treat it as the requirement.
- Do NOT invent requirements the brief does not state. If something matters and is not stated, say so and ask me, rather than assuming.
- Where you are inferring rather than reading, mark it as your inference.
- Do not guess what this ministry wants from its name. Its wording above is the only evidence.

---
Problem statement facts assembled by Wynit from National Technical Research Organisation (NTRO)'s published brief for SIH 2026.
The plain-English summary, the list of parts and the evaluator read are our interpretation of that text; the quoted title and the full description are theirs.

The government's original description (399 words)

• Background Modern enterprises generate massive volumes of logs from a wide range of sources, including network devices, servers, operating systems, applications, databases, cloud services, containers, endpoint security tools, identity and access management systems, IoT devices, and other hardware and software platforms. These logs are produced in diverse formats such as Syslog, JSON, XML, CSV, CEF, LEEF, proprietary vendor formats, and application-specific schemas. The diversity of log structures creates significant challenges in centralized monitoring, security operations, compliance reporting, incident investigation, and threat analytics. Security teams often spend substantial effort developing source-specific parsers and normalization rules before the data can be effectively utilized by SIEM, data lake, or machine learning platforms. As organizations adopt hybrid, multi-cloud, and AI-driven environments, the need for a universal and extensible log standard that can accommodate both current and future data sources have become increasingly critical. • Detailed Description Design and develop a Universal Log Pre-processing Framework (ULPF) capable of ingesting, parsing, normalizing, and standardizing logs and events generated by any hardware or software system. The framework should support diverse event sources while preserving the original event data for forensic and compliance purposes. It should transform heterogeneous logs into a unified schema that enables consistent analytics, correlation, visualization, threat hunting, anomaly detection, and machine learning applications. The framework must be scalable, extensible, vendor-agnostic, and suitable for deployment in Big Data environments handling billions of events per day. • Expected Solutions This solution should cover universal event schema and processing framework that enables: a) Preserve complete raw event data without information loss. b) Extract and parse source-specific attributes. c) Normalize fields into a common event taxonomy. d) Maintain traceability between normalized and original events. e) Plug-and-play on boarding of new log sources. f) Unified visibility across enterprise environments. g) Efficient SIEM and Data Lake integration. h) AI/ML-ready security and operational analytics. i) Reduced parser development effort. j) The solution shall be deployable in an air-gapped network. k) Solution may be packaged in a container for making it platform independent. • Current Scope Build a framework that converts any perimeter network device-generated log or eventâ€”regardless of source, format, vendor, or technology into a standardized, lossless, analytics-ready representation for next-generation SIEM and cybersecurity platforms. • Expected Solution/Deliverables for Evaluation • Source Code Link (GitHub/Drive Link) • Readme with Setup Instructions • Architecture Document (Max 2 Pages) • Demo Video (Max 2 Minutes) • Technical Presentation (Max 5 Slides)