> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/readme.md).

# XSIAM Data Model Schema

Cortex XSIAM enables you to map your logs into a single, unified data model. This data model provides a consolidated schema, and a simpler way to interact with your data, regardless of its source or dataset. This includes information about the Cortex Data Model (XDM) fields, consts, fieldsets, and aliases.

## How this reference is organized

This reference documents the Cortex Data Model (XDM). It is arranged into the following sections:

* [**Aliases**](/xsiam-data-model-schema/aliases.md) — Named groups of XDM fields you can reference in the Cortex Query Language (XQL) using a filter stage. Each alias resolves to a set of member fields.
* [**Consts**](/xsiam-data-model-schema/consts.md) — Enumerated constant sets (`XDM_CONST.*`). Each const page lists the original source values and the normalized XDM values they map to.
* [**Fieldsets**](/xsiam-data-model-schema/fieldsets.md) — Curated collections of XDM fields grouped for a common purpose, such as a pre-defined set of the most relevant fields.
* [**Fields**](/xsiam-data-model-schema/fields.md) — The XDM field tree (`xdm.*`). Container nodes group related fields; leaf nodes describe a single field with its datatype, dataclass, and examples.
* [**System Fields**](/xsiam-data-model-schema/system-fields.md) — The reserved system fields that Cortex XSIAM populates automatically for every event, such as `_time` and `_product`.

Each field describes its datatype and dataclass. When a field's datatype is an enumerated const, it links to the corresponding const page. Aliases and fieldsets link to the pages of the fields they reference wherever those fields can be resolved.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.