Can I onboard Enrichment data to Panther from S3 if my data is in a JSON array?

QUESTION

 Can I onboard Enrichment data from S3 If my data is in JSON array?

ANSWER

No, you cannot. If you are trying to onboard Enrichment data from S3, your logs must be formatted as either JSONL or CSV format. They cannot be in a JSON array.

If it is possible for your organization, use a third-party software to pre-process your data file before it's sent to S3 (e.g Cribl, Fluentd, etc).