MODEL - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

You can have multiple MODEL sections.

MODEL sections take parameters, and not names as RULE sections use, where some are mandatory and others are optional.

[MODEL: dataset=<dataset>, content_id=<content_id>]
<build the XQL logic>;

MODEL parameter names are not case-sensitive.

Cortex Data Model (XDM) System fields (_time, _insert_time, _vendor, _product) are mapped automatically from the dataset from the fields with the same names.

As section order is not significant, you do not have to declare a RULE before using it in a MODEL section.

Each field used in the MODEL and RULE sections is constructed using dot notation with a specific format. Each field must be part of the predefined field set of the data model's schema. However, temporary variables, which will not affect the modeling, may be used. For more information, see Field Structure.

A MODEL section can invoke a rule using the call stage.

In this example, both the RULE and MODEL sections are provided, so you can see how the call stage invokes the rule.

[RULE: common_ngfw_modeling]
alter xdm.source.ipv4 = json_extract_scalar(actor, "$.client_ip")
| alter xdm.network.ip_protocol = if(
	proto = 6, XDM_CONST.IP_PROTOCOL_TCP,
	proto = 11, XDM_CONST.IP_PROTOCOL_UDP,
	proto
);

[MODEL: dataset=panw_ngfw_traffic]
filter appid = "dns"
| call common_ngfw_modeling
| alter dns_helper = json_extract(event, "$.dns")
| alter xdm.network.dns.opcode = to_integer(json_extract_scalar(dns_helper, "$.opcode"),
        xdm.network.dns.is_truncated = to_boolean(json_extract_scalar(dns_helper, "$.is_truncated")
);

You can use the config case_sensitive stage in the MODEL section to configure whether field values in the XDM are evaluated as case sensitive or case insensitive. The config case_sensitive stage must be added at the beginnning of the query. If you do not provide this stage in your query, the default behavior is false; case is not considered when evaluating field values.

Cortex XSIAM enables analytics to run on the following data: