Data modeling

Before you create your schema, you must analyze the data that is likely to be available for analysis and understand how that data is used during an investigation. Based on your findings, you can create a data model that defines your data in terms of entities, links, and properties.

It is important to first establish the aim of your investigation when you are creating a data model because it can help organize data effectively. You can analyze your data and consider how it fits the basic concepts of data modeling.

The basic concepts of data modeling are formed by entities, links, and properties (ELP). Real world objects in your data can be expressed as entities, the association between those entities as links, and the values that characterize the entities and links as properties. Both entities and links are types of items; items contain properties and property groups, and properties can be placed in items or property groups.

The Schema Designer can be used to create a schema that is based on the data model's specifications.

Important: If your deployment is using data connectors with other sources of data, the shape of the data from those data connectors must also be modeled in your schema.