Data models
One firewall says client_ip, another source.ip. A data model gives them one name, src_ip, so a search, a detection or a dashboard works for every source at once.
Overview
A data model is a set of standard field names for one kind of event: logins, network traffic, web requests, DNS and so on. The built-in models follow Splunk CIM, Elastic ECS and OCSF, so the names are familiar if you come from another SIEM. You find them in the app under Data Models.
Built-in models
Every organization starts with 16 models.
| Model | Category | For |
|---|---|---|
| Authentication | Security | Logins, logouts and MFA |
| Endpoint | Security | Process execution and file changes on hosts |
| Firewall | Security | Allowed and blocked connections |
| Identity & Access Management | Security | Okta, Entra ID, Google Workspace, Active Directory: accounts, groups, roles, MFA |
| Network Traffic | Network | Connections and flows |
| DNS | Network | Queries and responses |
| Web Access | Application | HTTP requests and web server access logs |
| Application | Messages and delivery | |
| Application | Application | Application logs, errors and performance |
| Cloud Infrastructure | Infrastructure | Cloud resource changes and API activity |
| Database | Infrastructure | Queries, connections and performance |
| Host Process | Infrastructure | Process snapshots from the LogPulse agent and Linux audit |
| CI/CD Pipeline | Platform | GitHub Actions, GitLab CI, Tekton and others |
| GitOps Deployment | Platform | Argo CD and Flux CD sync and health |
| Security Event | Platform | Falco, OPA Gatekeeper, Kyverno, Trivy, Vault, cert-manager |
| Observability Event | Platform | Alertmanager, Grafana and Jaeger |
Fields
Every field in a model has these properties:
| Property | Meaning |
|---|---|
| Name | The canonical name, such as src_ip |
| Type | string, number, boolean, timestamp, ip, geo or object |
| Required | Whether an event of this kind must have it |
| Description and example | What the field holds, with a sample value |
| Aliases | Other names the same value arrives under |
| Allowed values | A fixed list, where it applies (for example logon_type) |
Aliases
Aliases do the normalizing. When a model is applied, a field that arrives under an alias is written under the canonical name. username, user.name and src_user all become user.
Example: Authentication
| Field | Type | Aliases |
|---|---|---|
action (required) | string: success, failure, lockout | result, status |
user (required) | string | username, user.name, src_user |
src_ip | ip | client_ip, source.ip |
auth_type | string | authentication_type, method |
mfa_method | string | second_factor |
logon_type | interactive, network, remote_interactive, service, batch, unlock | winlog.logon.type |
auth_protocol | password, kerberos, ntlm, saml, oauth, certificate | authentication.protocol |
is_privileged | boolean | |
src_country | string | source.geo.country_iso_code, src_geo_country |
Once your sources follow the model, one search covers all of them:
action=failure | stats count by user, src_ip | where count > 10Where models are used
| Where | How |
|---|---|
| Parsers | The parser builder names the fields it extracts after model fields. A value that fits no model lands in attributes.<name> |
| Agent configuration | Pick a data model per source in an agent template. The agent renames aliases to canonical names and converts numbers and booleans before it sends |
| Pipelines | The node Map Common Schema maps an event onto a model inside a pipeline |
| Agents | The Windows Event Log and IIS inputs arrive already mapped to Authentication, Endpoint and Web Access |
| Detections | Detection rules and KPIs are written against model fields, so they work on every source that follows the model |
| MCP server | AI assistants read a model with get_data_model before they propose a parser or detection |
Custom models
Create your own model for a source no built-in model covers, with New Data Model. To change a built-in model, press Customize: LogPulse makes a copy for your organization that you can edit, and the original becomes inactive for your organization only. Delete the copy to go back to the original.
API
| Call | What it does |
|---|---|
GET /api/v1/data-models | All models: built-in, custom, and built-in models replaced by a custom copy |
GET /api/v1/data-models/:id | One model with its fields |
POST /api/v1/data-models | Create a custom model |
PUT / DELETE /api/v1/data-models/:id | Change or delete a custom model |
Reading needs the permission dashboards:read, changing needs dashboards:update.