Skip to main content
Panther Knowledge Base

Retrieving nested data values with deep_get for a Panther Detection

QUESTION

 When I write a detection with Panther, how do I retrieve a value from a field in ingested data when the field is nested in other JSON fields?

ANSWER

You can use deep_get for this. deep_get is a Python helper function, available in panther_base_helpers, that returns a value nested in data at any depth. We use it in many detections and helpers, such as this one.

  • At the top of your detection code, add from panther_base_helpers import deep_get
  • Example JSON data:
  • ...
    "client": {
        "device": "Computer",
        "geographicalcontext": {
          "country": "United States",
          "geolocation": {
            "lat": "39.5022",
            "lon": "-106.1497"
          },
        },
        "useragent": {
          "browser": "CHROME",
          "os": "Mac OS X",
          "rawuseragent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML"
        }
      },
      ...
  • Examples (see data above): 
    • print(str(deep_get(event, "client", "device"))) # prints Computer
    • print(str(deep_get(event, "client", "geographicalcontext", "geolocation", "lat"))) # prints 39.5022
  • You may not need to convert the returned value to a string as shown, depending on what you're doing with it.

 

  • Was this article helpful?