Which process in Cortex XSIAM ensures that raw logs from different vendors (e.g., Check Point, Cisco, and Microsoft) are converted into a standardized format for unified analysis?
The XDM (Cortex Data Model) is the backbone of Cortex XSIAM's ability to act as a unified SOC platform.
Standardization: Raw logs come in many formats (Syslog, JSON, LEEF). XDM Mapping is the process of taking those raw fields and "mapping" them to a common schema. For example, "src_ip," "source_address," and "sIP" from different vendors are all mapped to a single XDM field called xdm.source.ipv4.
Cross-Vendor Correlation: Once data is mapped to XDM, an analyst can write one XQL query that searches across logs from all vendors simultaneously, which is essential for effective threat hunting in a multi-vendor environment.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit