Skip to main content
Panther Knowledge Base

What is the recommended way to do exception handling with Panther Detections?

QUESTION

What is the recommended way to do exception handling with Panther Detections?

ANSWER

Generally, detections should raise exceptions when either the logs don’t look like they need to (for example you believe a field MUST have a value and it doesn’t) or when an external thing (like an API call) fails. In these cases, you can either raise an exception yourself or more commonly just allow the exception to happen without catching it. This will not affect the ability of other rules to run.