> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax.md).

# Data Model Rules file structure and syntax

{% hint style="warning" %}

### Prerequisite

Data Model Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.
{% endhint %}

<details>

<summary>File structure</summary>

The Data Model Rules file consists of multiple sections of the following two types, which also represent the custom syntax specific to Data Model Rules:

* [MODEL](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/model.md): This section is used to define the mapping between a single dataset and the data model.
* (OPTIONAL) [RULE](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/rule.md): Rules are part of the Cortex Query Language (XQL) syntax, which are tagged with a name, and can be reused in the code in the **MODEL** sections, or in other **RULE** sections (recursively), by using `[rule:ruleName]`.

The order of the sections is not significant.

</details>

<details>

<summary>Syntax</summary>

The syntax used in the Data Model Rules file is derived from XQL, with a few modifications. This subset of XQL is called *XQL for Data Modeling (XQLm)*.

{% hint style="info" %}

### Note

For more information on XQL syntax, see the XQL Language Reference Guide.
{% endhint %}

In the `MODEL` and `RULE` sections, the following modifications apply to the XQLm syntax:

* Only the following XQL stages are permitted: [alter](/xql-command-reference-guide/readme/stages/alter.md) and [filter](/xql-command-reference-guide/readme/stages/filter.md). An additional `call` stage is supported, which is used to invoke another rule.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You cannot <code>call</code> a <code>RULE</code> section that exists in Default Rules from the User Defined Rules section.</p></div>
* No output stages are supported.
* `XDM_ALIAS` cannot be used in rules. It is only supported in queries. For more information, see the [search](/xql-command-reference-guide/readme/stages/search.md) stage.
* Every model definition in the Data Model Rules file must end with a semicolon (`;`).
* Each XDM field used in the `MODEL` and `RULE` sections is constructed using dot notation using the following format:

  ```programlisting
  xdm.[<context>].[<compound>].<field>
  ```

  For more information, see [Field structure](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/field-structure.md).

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.