thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Unified Data Model (UDM)

The normalized schema Google Security Operations uses to represent security events from all sources.

Definition

UDM defines entities (principal, target, src, observer) and event metadata so detections and searches work consistently across data sources. Parsers convert raw logs into UDM events.

Example

A Windows logon and an Okta login both mapped to USER_LOGIN UDM events with principal and target fields.

Exam tip

UDM is Google's equivalent of Splunk CIM or OCSF.

Related terms