Skip to main content
Panther Knowledge Base

How to troubleshoot ModuleNotFound error in Panther detection

Issue

You receive alerts from a detection that look similar to the following:

ModuleNotFoundError("No module named XXX")

This alerts occur when a detection is being checked against incoming events, or during a detection test run during development.

Resolution

To troubleshoot this issue, follow the steps below.

First, identify what type of module the error message is referring to. Check the module name, and consider the following:

  1. Is this one of the standard libraries that should be available to all Panther detections (like datetime, re, boto3, or requests)?
    • If so, first verify that the module is spelled correctly in your detection.
    • Confirm that our detection code is compatible with the latest version of the module. Panther updates Python packages during each new version deployment. If your detection is referencing a module with deprecated attributes/functions, they may be removed in a new Panther version, causing this error.
    • If you've verified both of the previous points and the code is still throwing errors, contact our support and inform them of the steps taken so far.
  2. Is this module a global helper (either a custom one or Panther provided)?
    • If so, please first confirm that the global helper is spelled correctly and is available:
      • Panther Console users: In the sidebar, navigate to Build > Helpers and verify that your helper module is listed.
      • CI/CD & PAT users: In your code repo, open the global_helpers folder in the repo root and look for a file with the same name as the helper module (ex. my_helper.py). 
    • If you were trying to import a specific object (using import OBJECT from HELPER notation), check that the helper module code defines the object you tried to import.
    • If you recently updated the helper file and are relying on those changes, wait 10 minutes then try again. It can take several minutes between changes to a helper being uploaded and those changes being applied to detections.
    • If none of the above steps resolve your error, contact support and inform them of the things you've already checked.
  3. Is this a third-party or custom module that you requested Panther staff make available to your detections?
    • How long ago was the request made? There can be a delay before custom/third party modules become available to your detections. Normally, a support person will let you know when they're successfully installed.
    • Is your detection compatible with the latest version of your 3rd party module? If not, have you instructed Panther support to prevent the module from being updated past a specific version? (By default, Panther uses the most recent available releases of all Python modules. If your code relies on legacy or deprecated features from a Python module, we advise you ask us to "pin" the module to a specific version that you confirm meets your needs.)
    • If you still haven't solved the issue, please contact our support. Be sure to mention that this is a custom or third/party module, and inform us of the steps you;ve already checked.

 

Cause

This error comes from the underlying Python kernel that runs your detections. For one reason or another, the Python kernel cannot find an installed library with a name matching your module. This can be due to the module being missing, nor having been installed to begin with, the import call being mispelled, or an update to the library which removed or altered the object you're attempting to use.