Skip to main content
Panther Knowledge Base

Is it possible to extract a nested field while ingesting logs to Panther?


 Is it possible to extract a field and make that a column at ingestion time, even if it is nested? I want to make it a separate schema field.



Yes, you can do this with data transformations. By performing a copy on the nested field, then doing a rename on the copied field, you can turn a nested field into a top-level field as the data is ingested.

If you are looking to normalize your data to create detections for multiple log types, see the documentation on Panther Data Models for more information.

  • Was this article helpful?