Skip to main content
Panther Knowledge Base

What is the default alert_context if I don't have an alert_context function in my Panther detection?

QUESTION

What is the default alert_context if I don't have an alert_context function in my Panther detection?

ANSWER

The default is null unless you intentionally set it in your rule.
The function alert_context should return a dictionary, as shown in this rule template in Panther's Github and this Okta rule.

 

  • Was this article helpful?