Data Model Rules editor views - Learn about the Data Model Rules editor User Defined Rules, Default Rules, and Both views. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation
Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-04
Category
Administrator Guide
Abstract

Learn about the Data Model Rules editor User Defined Rules, Default Rules, and Both views.

Prerequisite

Data Model Rules requires View/Edit RBAC permissions for Data Management (under Configurations → Data Management), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.

The Data Model Rules editor contains the following views.

  • User Defined Rules (default): Displays an editor for writing your own custom Data Model Rules that override the default rules. Once you edit a default Data Model mapping, you will no longer receive Marketplace updates.

  • Default Rules (read-only): Displays the data model rules that are provided by default.

  • Both: Side-by-side view of both the Default Rules and User Defined Rules, so that you can easily view both sets of rules on the same screen.