Systems and methods for automatically creating normalized security events in a cybersecurity threat detection and mitigation platform

A computer-implemented method comprising:

• at a cybersecurity service implemented by a network of distributed computers:
• obtaining raw event data from a third-party security device of a subscriber;
• automatically generating a pre-normalized security event that includes the raw event data in a first structured data object in response to executing an automated event ingestion instruction, wherein:
• the pre-normalized security event includes a set of un-normalized evidence data fields extracted from the raw event data;
• automatically transforming the pre-normalized security event to at least one normalized security event, wherein automatically transforming the pre-normalized security event to the at least one normalized security event includes:
• converting the set of un-normalized evidence data fields of the pre-normalized security event to a set of normalized evidence data fields using a set of computer-executable data mapping instructions included in a security data integration created for the third-party security device;
• automatically assessing a corpus of computer-executable detection instructions against the at least one normalized security event;
• generating a security alert based on the at least one normalized security event satisfying a set of alerting conditions of a subject computer-executable detection instruction of the corpus of computer-executable detection instructions;
• and
• executing a threat mitigation response that mitigates a security threat associated with the security alert.