Schema change

A schema change is an edit to how log fields are named, typed or nested, whether in the source system, the parser or the normalisation layer. Rules written against the old schema may stop matching. Schema changes are the usual trigger of field drift.

What Schema change means here

Normalised models such as ECS, OCSF or the Unified Data Model reduce the damage because rules target the model, not the raw log. They do not remove it, because parser changes still move fields.

Watch for classification errors on ingestion. They are an early sign that logs no longer fit the schema.

Example of Schema change in Panther documentation

Panther's System Errors include Log Classification Errors for logs that fail their schemas, and the docs do not tie those errors to the fields a rule uses. docs.panther.com read 2026-11-03

Terms related to Schema change

• Field drift: Field drift is when the fields a rule depends on change name, type or meaning, or stop appearing, so the rule quietly stops matching.
• Log source health: Log source health is whether each log source is sending data on time and in the expected shape.
• Rule health: Rule health is whether a detection still runs, still sees its data and still earns its alerts.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.