Skip to main content
Panther Knowledge Base

What is the difference between get and deep_get when writing detections in Panther?


What is the difference between get and deep_get?


In a string context, we usually recommend that you use the form of deep_get(event, 'whatever', default='<NO_WHATEVER>'). See below for more information on the differences.

  • dictionary.get('thing', 'value-if-not-present') 
    • This call will return None if the thing exists and has value of None
  • deep_get(dictionary, 'thing', default='something'
    • this call will return the value of the default= kwarg if the thing exists and has a value of None.