Panther.Detection.Deleted fires with a broken AlertContext

Last updated
Save as PDF

Issue

This detection, Panther.Detection.Deleted triggers normally but the AlertContext fails with a {"_error":"TypeError(\"'NoneType' object is not iterable\")"} error message.

Resolution

The Panther engineering team is aware of this issue and investigating a fix. While a timeline is not currently available for this fix, you can send further questions or concerns to Panther's support team.

Cause

This issue occurs due to the logic in def alert_context(event):, more specifically the "deleted_detections_list": [x.get("id") for x in detections_list],, which tries to iterate through None type value.

This happens due to lack of input field in the actionParams field of the event in this line detections_list = deep_get(event, "actionParams", "input", "detections").