> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/using-data-enrichment.md).

# Using data enrichment

{% hint style="warning" %}

### Prerequisite

Data Model Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.
{% endhint %}

Cortex XSIAM automatically enriches your Cortex Data Model (XDM) data with additional information and context. Some examples of the types of data that are enriched include:

{% hint style="info" %}

### Note

For a complete list of auto-enriched fields, see the [XSIAM Data Model Schema](/xsiam-data-model-schema/readme.md).
{% endhint %}

* IP addresses are enriched with geolocation information.
* User data is normalized.
* If DSS exists, it is also enriched.

These enrichments are important for cyber analytics, rule detection, and investigations. Since these fields are enriched automatically by default, they do not have to be mapped manually in Data Model Rules. Note that enrichment is not performed when the input fields needed for enrichment are not available.

Enriched data is calculated by the system upon ingestion, and is saved for future queries. Keep in mind that some data may change over time, such as IP addresses that may change geolocation. Therefore, checking the same IP address in external systems at a later time might return a different geolocation result.

<details>

<summary>Overriding Data Enrichment</summary>

We do not recommend overriding enriched fields. However, if enriched fields are not desired, they can be overridden by mapping data to fields that are usually enriched.

```programlisting
[MODEL: dataset=okta_sso_raw]
| alter xdm.source.ip = actor->ip_address,
      xdm.source.location.country = actor->country,
      xdm.source.location.city = actor->geo.city;
```

When overriding enriched fields, ensure the following:

* The overridden data should be normalized.
* All relevant enriched fields should be overridden (for example, all location fields), and empty values should be filled with “unknown” (or with NULL, if calculated enrichments are desired). These actions will prevent data mismatch and conflicts.

{% hint style="info" %}

### Important

When manually mapping ASN fields that are enriched, such as `xdm.source.asn.as_number`, with other ISP and domain fields that are not enriched, such as `xdm.source.asn.isp` and `xdm.source.asn.domain`, it's possible to receive incorrect XDM query results due to the misalignment between the overridden enrichement and system enrichment fields.
{% endhint %}

</details>

<details>

<summary>Limitations</summary>

* Geolocation limitations
  * Some values will be NULL if the log country doesn't match the country detected by an external geolocation tool.
  * There might be discrepancies when some data come from the log and other data from the enrichment. For example, log country data versus enrichment longitude data.
* Data enrichment is not performed for EDR events.
* This feature is not supported in cold storage.

</details>

<details>

<summary>Backward compatibility</summary>

Data ingested by versions prior to Cortex XSIAM version 1.3 will not be enriched, because enrichment is calculated at the time of ingestion.

By default, enrichment is performed for NULL values only (non-NULL values are not overridden). Therefore, some existing mapping rules may need to be updated, in order to prevent mapping data to the enriched fields. Contact Customer Support for assistance with converting custom modeling rules and saved queries.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/using-data-enrichment.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.