Accessing event data fields with a slash ( / ) in the name, using Panther Simple Detections
Issue
When configuring a rule using the Simple Detection Builder, I created a condition that checks a data field whose name contains a slash ( / ). An error appeared when I tried to deploy the detection, and an error screen appears when I try to run a test.
Resolution
Currently, Panther's Simple Detections cannot access data fields whose names contain a slash ( / ), so the workaround is to write a rule using Python. For assistance with this, please contact Panther Support.
Cause
This issue occurs due to a Panther bug. The Panther engineering team is aware of the issue and plans to address it in a future update.