Data Model Rules notifications - Learn more about the notifications that are relevant for Cortex XSIAM Data Model Rules. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation
Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-04
Category
Administrator Guide
Abstract

Learn more about the notifications that are relevant for Cortex XSIAM Data Model Rules.

Prerequisite

Data Model Rules requires View/Edit RBAC permissions for Data Management (under Configurations → Data Management), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.

To help you monitor effectively your Data Model Rules, Cortex XSIAM sends notifications to your Cortex XSIAM console Notification Center.

Cortex XSIAM sends the following notification:

  • Invalid Data Model Rules: Notifies when a Data Model Rule is invalid and will be excluded from datamodel queries.

To ensure you and your colleagues stay informed about Data Model Rules activity, you can also Configure notification forwarding to forward your Data Model Rules logs to an email distribution list or Syslog server. For more information about the Data Model Rules audit logs, see Monitor Data Model Rules activity.