Skip to main content
Panther Knowledge Base

Can I join two Lookup Tables within a Panther rule?

  1. Last updated
  2. Save as PDF

QUESTION

Can two Lookup Tables be joined within a Panther rule?

ANSWER

This is not possible.  If you require data from two different Lookup Tables in your detection process, you must either configure the tables to enrich the same event or consolidate them into a single Lookup Table.