Skip to main content
Panther Knowledge Base

Can I onboard Enrichment data to Panther from S3 if my data is in a JSON array?


 Can I onboard Enrichment data from S3 If my data is in JSON array?


No, you cannot. If you are trying to onboard Enrichment data from S3, your logs must be formatted as either JSONL or CSV format. They cannot be in a JSON array.

If it is possible for your organization, use a third-party software to pre-process your data file before it's sent to S3 (e.g Cribl, Fluentd, etc).


  • Was this article helpful?