Skip to main content
Panther Knowledge Base

Accessing event data fields with a slash ( / ) in the name, using Panther Simple Detections


When configuring a rule using the Simple Detection Builder, I created a condition that checks a data field whose name contains a slash ( / ). An error appeared when I tried to deploy the detection, and an error screen appears when I try to run a test.


​​​​​Currently, Panther's Simple Detections cannot access data fields whose names contain a slash ( / ), so the workaround is to write a rule using Python. For assistance with this, please contact Panther Support.


This issue occurs due to a Panther bug. The Panther engineering team is aware of the issue and plans to address it in a future update.

  • Was this article helpful?