1. A machine-readable medium encoded with: a plurality of software modules, wherein each software module is configured to receive a normalized event, to modify the normalized event, and to output the modified normalized event; and software agent instructions that, when executed by a processor, cause the processor to perform instructions comprising: receiving, from a first device, an event, that originated in an event log that was generated by the first device; parsing the event received from the first device; creating a normalized event based on the parsed event; modifying the normalized event using a set of software modules, wherein the set of software modules comprises two or more software modules of the plurality of software modules and does not comprise all of the plurality of software modules; and transmitting the modified normalized event to a second device; wherein a configuration file, associated with the software agent instructions, indicates which software modules of the plurality of software modules are in the set of software modules that are used by the software agent instructions, and wherein the configuration file is stored on a second machine-readable medium.