> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/field-structure.md).

# Field structure

{% hint style="warning" %}

### Prerequisite

Data Model Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.
{% endhint %}

When creating Data Model Rules, each field used in the `MODEL` and `RULE` sections is constructed using dot notation using the following format:

```programlisting
xdm.<context>.[<compound>].<field>
```

* `xdm.<context>.[<compound>].<field>`

  Example 53.

  ```programlisting
  xdm.source.host.device_id
  ```
* `xdm.<context>.<field>`

  Example 54.

  ```programlisting
  xdm.source.ipv4
  ```

| Part         | Description                                                                                                                                                                     |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<context>`  | This is a composition of fields (`<field>`), either simple or `<compound>`, that are grouped together to form a logically coherent unit.                                        |
| `<compound>` | This is a set of simple fields that are grouped together to form a meaningful group. For example, `subject` and `recipients` are part of the `<compound>` field called `email`. |
| `<field>`    | This is a field that represents a primitive data type, such as a string or number or an array, or an IP address.                                                                |

{% hint style="info" %}

### Note

For more information on these data model fields, see [XSIAM Data Model Schema](/xsiam-data-model-schema/readme.md).
{% endhint %}

<details>

<summary>Using ENUM fields</summary>

For fields of the `ENUM` type, you can map values from a predefined list of ENUMs. For example, the field `xdm.network.ip_protocol` is defined as `Enum.IP_PROTOCOL`, so you can assign it values such as `XDM_CONST.IP_PROTOCOL_TCP`. The full list can be found in the automatically suggested values for the relevant fields.

This syntax is not mandatory, and you can map any `STRING` value, but we recommend its use for consistency across all model mapping.

```programlisting
[RULE: common_ngfw_modeling]
alter xdm.source.ipv4 = json_extract_scalar(actor, "$.client_ip")
| alter xdm.network.ip_protocol = if( 
    proto = 6, XDM_CONST.IP_PROTOCOL_TCP, 
    proto = 11, XDM_CONST.IP_PROTOCOL_UDP, 
    proto
);
```

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/field-structure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.