XSIAM Data Model Schema

Cortex XSIAM enables you to map your logs into a single, unified data model. This data model provides a consolidated schema, and a simpler way to interact with your data, regardless of its source or dataset. This includes information about the Cortex Data Model (XDM) fields, consts, fieldsets, and aliases.

How this reference is organized

This reference documents the Cortex Data Model (XDM). It is arranged into the following sections:

• Aliases — Named groups of XDM fields you can reference in the Cortex Query Language (XQL) using a filter stage. Each alias resolves to a set of member fields.
• Consts — Enumerated constant sets (XDM_CONST.*). Each const page lists the original source values and the normalized XDM values they map to.
• Fieldsets — Curated collections of XDM fields grouped for a common purpose, such as a pre-defined set of the most relevant fields.
• Fields — The XDM field tree (xdm.*). Container nodes group related fields; leaf nodes describe a single field with its datatype, dataclass, and examples.
• System Fields — The reserved system fields that Cortex XSIAM populates automatically for every event, such as _time and _product.

Each field describes its datatype and dataclass. When a field's datatype is an enumerated const, it links to the corresponding const page. Aliases and fieldsets link to the pages of the fields they reference wherever those fields can be resolved.