Data Model Rules Editor Views - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product
Cortex XSIAM
Creation date
2024-02-26
Last date published
2024-04-21
Category
Administrator Guide
Abstract

Learn about the Data Model Rules editor User Defined Rules, Default Rules, and Both views.

Note

Only a user with Cortex Account Administrator or Instance Administrator permissions can access Data Model Rules.

The Data Model Rules editor contains the following views.

  • User Defined Rules (default)—Displays an editor for writing your own custom Data Model Rules that override the default rules. Once you edit a default Data Model mapping, you will no longer receive Marketplace updates.

  • Default Rules (read-only)—Displays the data model rules that are provided by default.

  • Both—Side-by-side view of both the Default Rules and User Defined Rules, so that you can easily view both sets of rules on the same screen.