QuestionQ23Verified/Planning and InstallationCopy linkReport a problemAsk AstroTutorSave questionWhat is the purpose of the MODEL section when creating a data model rule?ATo make a list of all the relevant fields to be mapped from the logs to XDMBTo define the mapping between a single dataset and XDMCTo finalize rule definition with all XQL statementsDTo map log fields to corresponding Cortex XSIAM Data Model (XDM) fieldsShow AnswerAnswerExplanationA MODEL section defines the mapping between a single dataset and the Cortex XSIAM data model (XDM). It is mandatory for each dataset in a Data Model Rules file.Learn moreMODEL — Cortex XSIAM Administrator GuideData Model Rules file structure and syntax — Cortex XSIAM Administrator GuideShow comments2Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion