Data Model Rules Editor Views - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Learn about the Data Model Rules editor User Defined Rules, Default Rules, and Both views.


Only a user with Cortex Account Administrator or Instance Administrator permissions can access Data Model Rules.

The Data Model Rules editor contains the following views.

  • User Defined Rules (default)—Displays an editor for writing your own custom Data Model Rules that override the default rules. Once you edit a default Data Model mapping, you will no longer receive Marketplace updates.

  • Default Rules (read-only)—Displays the data model rules that are provided by default.

  • Both—Side-by-side view of both the Default Rules and User Defined Rules, so that you can easily view both sets of rules on the same screen.