Skip to main content
Panther Knowledge Base

How does Panther match custom schemas if multiple schemas are used?

  1. Last updated
  2. Save as PDF

QUESTION

How does Panther match custom schemas if multiple schemas are used? What are the best practices when using multiple schemas when matching against logs?

ANSWER

How Panther matches schemas:

The order in which a schema match is performed is random.

For an example of the schema ordering process when a file comes through:

  1. On the first line, we try the schema randomly. 
    If not matched (Failure):
  2. We try again randomly.
    In this example, the second schema Matched (Success).
  3. Second line: We will try the second schema first (the one matched).

On the next file, we will try again the schemas randomly.

 

Best practices when using multiple schemas when matching against logs

  • Use Prefix Filters. 
  • If you can't use Prefix Filters, use validate allow options.
  • Use required: true on unique fields (make sure they are in every event).