> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/readme.md).

# XSIAM Data Model Schema

Cortex XSIAM enables you to map your logs into a single, unified data model. This data model provides a consolidated schema, and a simpler way to interact with your data, regardless of its source or dataset. This includes information about the Cortex Data Model (XDM) fields, consts, fieldsets, and aliases.

## How this reference is organized

This reference documents the Cortex Data Model (XDM). It is arranged into the following sections:

* [**Aliases**](/xsiam-data-model-schema/aliases.md) — Named groups of XDM fields you can reference in the Cortex Query Language (XQL) using a filter stage. Each alias resolves to a set of member fields.
* [**Consts**](/xsiam-data-model-schema/consts.md) — Enumerated constant sets (`XDM_CONST.*`). Each const page lists the original source values and the normalized XDM values they map to.
* [**Fieldsets**](/xsiam-data-model-schema/fieldsets.md) — Curated collections of XDM fields grouped for a common purpose, such as a pre-defined set of the most relevant fields.
* [**Fields**](/xsiam-data-model-schema/fields.md) — The XDM field tree (`xdm.*`). Container nodes group related fields; leaf nodes describe a single field with its datatype, dataclass, and examples.
* [**System Fields**](/xsiam-data-model-schema/system-fields.md) — The reserved system fields that Cortex XSIAM populates automatically for every event, such as `_time` and `_product`.

Each field describes its datatype and dataclass. When a field's datatype is an enumerated const, it links to the corresponding const page. Aliases and fieldsets link to the pages of the fields they reference wherever those fields can be resolved.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/readme.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.