---
slug: /cse/schema
title: Cloud SIEM Schema
description: Learn about Cloud SIEM Schema v3, schema attributes, and the record processing pipeline.
canonical: https://www.sumologic.com/help/docs/cse/schema/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

This guide has information about Cloud SIEM schemas. In this section, we'll introduce the following concepts:

<div className="box-wrapper" >
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/record-processing-pipeline')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Record Processing Pipeline</h4></a>
  <p>Learn how Cloud SIEM transforms incoming raw messages into records.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/schema-attributes')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Cloud SIEM Schema Attributes</h4></a>
  <p>Learn about Cloud SIEM schema attributes.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/attributes-map-to-records')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Mappable Attributes</h4></a>
  <p>Learn what Cloud SIEM schema attributes you can map to records.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/cse-record-types')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Record Types</h4></a>
  <p>Learn about the record types to which you can map schema attributes.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/create-structured-log-mapping')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Log Mapping</h4></a>
  <p>Learn how to create a log mapping for structured messages.</p>
  </div>  
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/cse-normalized-classification')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Normalized Classification</h4></a>
  <p>Set up schema fields with an enforced, Cloud SIEM-defined output.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/field-mapping-security-event-sources')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Field Mappings</h4></a>
  <p>Set up field mappings for messages that you want to be processed by Cloud SIEM's normalized threat rules.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/parser-editor')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Parser Editor</h4></a>
  <p>Learn how to use the Parser Editor to configure and test a custom parser.</p>
</div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/parsing-language-reference-guide')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Parsing Language Reference</h4></a>
  <p>Parsing is the first step in the Cloud SIEM record processing pipeline.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/parsing-patterns')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Parsing Patterns</h4></a>
  <p>Learn about predefined named regular expressions used in regex-based parsers.</p>
  </div>
</div>
<div className="box smallbox card">
  <div className="container">
  <a href={useBaseUrl('docs/cse/schema/username-and-hostname-normalization')}><img src={useBaseUrl('img/icons/operations/schema.png')} alt="Flow diagram icon" width="40"/><h4>Username and Hostname Normalization</h4></a>
  <p>Learn about how Cloud SIEM normalizes usernames and hostnames during mapping and parsing.</p>
  </div>
</div>
</div>