---
title: "Working with Data Model Rules"
description: "Veeam App for Palo Alto Networks XSIAM provides predefined Cortex Data Model (XDM) Rules that map the data received from Veeam Backup & Replication or Veeam ONE servers to the XSIAM Data Model Schema."
canonical: "https://helpcenter.veeam.com/docs/security_plugins_xsiam/guide/xsiam_data_model_rules.html"
breadcrumb: "User Guide > Working with Data Model Rules"
dateModified: "2026-08-21"
---

# Working with Data Model Rules

Veeam App for Palo Alto Networks XSIAM provides predefined Cortex Data Model (XDM) Rules that map the data received from Veeam Backup & Replication or Veeam ONE servers to the XSIAM Data Model Schema. This allows you to use the data across all Cortex XSIAM data sources.

For more information on Data Model Rules and XSIAM Data Model Schema, see [this section](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules) in the Cortex XSIAM documentation.

## Viewing Data Model Rules

You can find Veeam Data Model Rules in the **Settings** > **Configurations** > **Data Management** > **Data Model Rules** section, on the **Default Rules** tab. Data mapping is based on the *veeam_veeam_raw* dataset.

## Using Search Queries

This section contains examples of XQL search queries that include Veeam data and XSIAM Data Model Schema. You can display required information on specific Veeam Backup & Replication events and Veeam ONE alarms filtering data by any parameter available in the dataset, for example, event ID, severity, and so on.

::: dropdown
### Viewing Events with Critical Severity

The query displays all Veeam Backup & Replication events and Veeam ONE alarms with the *Critical* severity.

**XQL Query**:

```
datamodel dataset = veeam_veeam_raw
  | filter xdm.alert.severity = "Critical"
  | fields _time,
           xdm.event.id,
           xdm.event.description,
           xdm.event.operation_sub_type,
           xdm.alert.severity,
           xdm.observer.name,
           xdm.observer.version,
           xdm.target.resource.id,
           xdm.target.resource.name
  | limit 10
```
:::

::: dropdown
### Viewing Malware Activity Detected Events

The query displays all Veeam Backup & Replication events with ID 41600 (Malware Activity Detected). The event is sent when malware activity detected on the backup infrastructure. Highest-severity ransomware indicator in the data model.

**XQL Query**:

```
datamodel dataset = veeam_veeam_raw
  | filter xdm.event.id = "41600"
  | fields _time,
           xdm.event.id,
           xdm.event.description,
           xdm.event.operation_sub_type,
           xdm.alert.severity,
           xdm.observer.name,
           xdm.observer.version,
           xdm.target.resource.id,
           xdm.target.resource.name
  | limit 10
```
:::

::: dropdown
### Viewing Four-Eyes Authorization Disabled Events

The query displays all Veeam Backup & Replication events with ID 42401 (Four-Eyes Authorization Disabled). The event is sent when a user disables four-eyes authorization. This removes a key approval control and is often a step taken just before a destructive or malicious action.

**XQL Query**:

```
datamodel dataset = veeam_veeam_raw
  | filter xdm.event.id = "42401"
  | fields _time,
           xdm.event.id,
           xdm.event.description,
           xdm.event.operation_sub_type,
           xdm.alert.severity,
           xdm.source.user.username,
           xdm.observer.name,
           xdm.observer.version,
           xdm.target.resource.id,
           xdm.target.resource.name
  | limit 10
```
:::

::: dropdown
### Viewing Backup Repository Deleted Events

The query displays all Veeam Backup & Replication events with ID 28200 (Backup Repository Deleted). The event is sent when a user deletes a backup repository from the backup infrastructure. Directly targets the last line of defense against ransomware and data loss.

**XQL Query**:

```
datamodel dataset = veeam_veeam_raw
  | filter xdm.event.id = "28200"
  | fields _time,
           xdm.event.id,
           xdm.event.description,
           xdm.event.operation_sub_type,
           xdm.alert.severity,
           xdm.source.user.username,
           xdm.observer.name,
           xdm.observer.version,
           xdm.target.resource.id,
           xdm.target.resource.name
  | limit 10
```
:::

::: dropdown
### Viewing Microsoft 365 Backup Job Disabled Alarms

The query displays all Veeam ONE triggered alarms with ID 378 (Microsoft 365 Backup Job Disabled). The alarm is triggered when a Microsoft 365 backup job is disabled. Flags a gap in backup coverage that an attacker or an unauthorized user could use to stop protection before an attack.

**XQL Query**:

```
datamodel dataset = veeam_veeam_raw
  | filter xdm.event.id = "378"
  | fields _time,
           xdm.event.id,
           xdm.event.description,
           xdm.event.outcome,
           xdm.alert.name,
           xdm.alert.severity,
           xdm.alert.category,
           xdm.observer.name,
           xdm.target.resource.name,
           xdm.target.resource.value
  | limit 10
```
:::