What is the Unified Data Model (UDM)?

The Unified Data Model is the standardized schema Google SecOps normalizes every ingested log into, regardless of its original source or format, so that events from wildly different systems — a firewall, a cloud audit log, an endpoint agent — can be searched, correlated, and written detection rules against using one consistent set of field names.

Normalization happens at ingestion time using a schema-on-write approach: as a raw log arrives, a parser transforms it into UDM fields (like principal.hostname, target.ip, or metadata.event_type) before it's stored, rather than leaving raw, differently-structured logs to be reconciled at query time.

This upfront normalization is what makes downstream detection rules (written in YARA-L) and searches fast and consistent: a rule looking for suspicious authentication activity can reference metadata.event_type = "USER_LOGIN" and expect that field to mean the same thing whether the underlying log came from Active Directory, Okta, or a cloud provider's identity service, rather than needing separate logic per log source.