Skip to main content
Panther Knowledge Base

How does Panther match custom schemas if multiple schemas are used?

QUESTION

 How does Panther match custom schemas if multiple schemas are used? What are the best practices when using multiple schemas when matching against logs?

ANSWER

How Panther matches schemas:

The order in which a schema match is performed is alphabetical by schema name.

For an example of the schema ordering process when a file comes through:

  1. On the first line, we try the first schema alphabetically. 
    If not matched (Failure):
  2. We try again the second schema.
    In this example, the second schema Matched (Success).
  3. Second line: We will try the second schema first (the one matched).

On the next file, we will try again the first schema (alphabetically)

 

Best practices when using multiple schemas when matching against logs

  1. Use Prefix Filters. 
  2. If you can't use Prefix Filters, use validate allow options.
  3. Use required: true on unique fields (make sure they are in every event).