Data Model Rules editor views

Navigate the Cortex XSIAM Data Model Rules editor.

Data Model Rules requires View/Edit RBAC permissions for Data Management (under Configurations → Data Management), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.

The Data Model Rules editor contains the following views.

• User Defined Rules (default): Displays an editor for writing your own custom Data Model Rules that override the default rules. Once you edit a default Data Model mapping, you will no longer receive Marketplace updates.
• Default Rules (read-only): Displays the data model rules that are provided by default.
• Both: Side-by-side view of both the Default Rules and User Defined Rules, so that you can easily view both sets of rules on the same screen.