> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules.md).

# Data Model Rules

Map source data to the Cortex XSIAM data model using default or custom rules.

### What are Data Model Rules?

{% hint style="warning" %}
Data Model Rules require **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.
{% endhint %}

Cortex XSIAM enables you to map your logs into a single, unified data model. This data model provides a consolidated schema and a simpler way to interact with your data, regardless of its source or dataset. To familiarize yourself with the data model schema, see [XSIAM Data Model Schema](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/).

You can map your data to the data model using Data Model Rules, either by using the Default Rules that are automatically added when installing Content Packages from the Marketplace, or by creating user-defined rules. You create rules with the Data Model Rules editor, which enables you to do the following:

* Map 3^(rd) party data to a consolidated schema with predefined data types.
* Enjoy auto-complete and mapping suggestions.
* Map multiple queryable datasets to the data model.

Data Model Rules contain the following built-in characteristics:

* Each Data Model Rule is mapped between one dataset and the data model.
* A Data Model Rule takes rows from a dataset to use as an input, performs an arbitrary number of transformations and modifications on each column in the dataset using Cortex Query Language (XQL), and then returns the normalized rows with the corresponding data model’s schema.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.