The Great Standard • Room 2

Tags and Aliases

CIM relies heavily on Tags and Field Aliases to normalize data.

**Field Aliases** map an original field name (e.g., `src_ip`) to a CIM-compliant field name (`src`).

**Tags** apply standard labels (e.g., `network`, `communicate`) to `eventtypes` so datasets can be grouped into CIM Data Models.

Searching CIM Tags

tag=network tag=communicate src=10.0.0.1

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

clientip -> src

action="failure" -> "authentication"

Maps field names

Used to populate Data Models

Alias

Tag