The **Common Information Model (CIM)** is a shared semantic model focused on extracting and normalizing value from data.
Instead of worrying if a firewall vendor calls a blocked action "denied", "dropped", or "blocked", CIM maps it all to `action=blocked`.
This allows you to write one search that works across all your different data sources.