Skip to main content
Panther Knowledge Base

How to resolve "invalid header" error when trying to ingest AWS VPC flow logs through Cloudwatch in Panther

Issue

I am seeing the following error message when ingesting VPC flow logs through CloudWatch: invalid header

The payload looks correct when compared to the schema.

Resolution

To avoid this error, you can send your VPC Flow logs directly to your S3 bucket and then to Panther, using Panther's AWS.VPCFlow schema.

Cause

Sending your VPC Flow logs to Panther through CloudWatch is not supported using our native integration. 

 

  • Was this article helpful?