> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/troubleshooting-data-model-rules.md). # Troubleshooting Data Model Rules {% hint style="warning" %} ### Prerequisite Data Model Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding. {% endhint %} To help you easily identify and resolve errors related to invalid Cortex Data Model (XDM) Rules, Cortex XSIAM provides the following: * When an XDM query runs and one of the Data Model Rules is invalid, the invalid rule is automatically disabled and excluded from the query, and a warning is displayed. * When a Data Model Rule is disabled, a message is added to your Cortex XSIAM console Notification Center. For more information about the Data Model Rules notifications, see [Data Model Rules notifications](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-notifications.md). * The Data Model Rules editor displays an error icon and a message beside invalid Data Model Rules. * An audit log is added to the Management Audit Log whenever a Data Model Rule becomes invalid, and when an invalid Data Model Rule becomes valid.

Tip

To ensure you and your colleagues stay informed about Data Model Rules activity, you can also Configure notification forwarding to forward your Data Model Rules audit logs to an email distribution list or Syslog server. For more information about the Data Model Rules audit logs, see Monitor Data Model Rules activity.

* When a rule is fixed, it is automatically enabled. User defined Data Model Rules are updated manually in the User Defined Rules editor. While default Data Model Rules are updated as part of a Marketplace package update, or a background change, such as an XQL content change. * All Data Model Rules compilation errors are added to the `parsing_rules_errors` dataset. **Dataset for Data Model Rules Errors** All Data Model Rules compilation errors, such as syntax errors, missing arguments, and invalid regex, are saved to a dataset called `parsing_rules_errors`. This dataset also includes Parsing Rules errors. The following table describes the fields that are applicable to troubleshooting Data Model Rules errors when running a query in XQL Search for the `parsing_rules_errors` dataset in alphabetical order. {% hint style="info" %} ### Note Since this dataset also contains Parsing Rules errors, some of the fields are irrelevant for Data Model Rules and aren't included in the table. {% endhint %}
Read more... | Field | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------- | | CREATED\_AT | Displays the timestamp when the error was generated. | | ERROR\_CATEGORY | Displays the category of the error, which for Data Model Rules errors is always **Compile** for compilation errors. | | ERROR\_MESSAGE | Displays the error message. | | \_ID | Displays the Rule ID that triggered this error. | | RULE\_TYPE | Displays the type of rule that triggered this error. | | TARGET\_DATASET | Displays the target dataset associated to the rule that triggered this error. | | \_TIME | Displays the timestamp when the error was generated. | | XQL\_TEXT | Displays the specific section of the Data Model Rule related to the error generated. |
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/troubleshooting-data-model-rules.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.