> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax.md).

# Data Model Rules file structure and syntax

Learn Cortex XSIAM Data Model Rules file structure and syntax.

{% hint style="warning" %}

### Prerequisite

Data Model Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Parsing Rules, and Event Forwarding.
{% endhint %}

<details>

<summary>File structure</summary>

The Data Model Rules file consists of multiple sections of the following two types, which also represent the custom syntax specific to Data Model Rules:

* [MODEL](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/model.md): This section is used to define the mapping between a single dataset and the data model.
* (OPTIONAL) [RULE](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/rule.md): Rules are part of the Cortex Query Language (XQL) syntax, which are tagged with a name, and can be reused in the code in the **MODEL** sections, or in other **RULE** sections (recursively), by using `[rule:ruleName]`.

The order of the sections is not significant.

</details>

<details>

<summary>Syntax</summary>

The syntax used in the Data Model Rules file is derived from XQL, with a few modifications. This subset of XQL is called *XQL for Data Modeling (XQLm)*.

{% hint style="info" %}

### Note

For more information on XQL syntax, see the XQL Language Reference Guide.
{% endhint %}

In the `MODEL` and `RULE` sections, the following modifications apply to the XQLm syntax:

* Only the following XQL stages are permitted: [alter](/xql-command-reference-guide/readme/stages/alter.md) and [filter](/xql-command-reference-guide/readme/stages/filter.md). An additional `call` stage is supported, which is used to invoke another rule.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You cannot <code>call</code> a <code>RULE</code> section that exists in Default Rules from the User Defined Rules section.</p></div>
* No output stages are supported.
* `XDM_ALIAS` cannot be used in rules. It is only supported in queries. For more information, see the [search](/xql-command-reference-guide/readme/stages/search.md) stage.
* Every model definition in the Data Model Rules file must end with a semicolon (`;`).
* Each XDM field used in the `MODEL` and `RULE` sections is constructed using dot notation using the following format:

  ```programlisting
  xdm.[<context>].[<compound>].<field>
  ```

  For more information, see [Field structure](/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/field-structure.md).

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.