Can I onboard Enrichment data to Panther from S3 if my data is in a JSON array?

Last updated
Save as PDF

QUESTION

Can I onboard Enrichment data from S3 If my data is in JSON array?

ANSWER

No, you cannot. If you are trying to onboard Enrichment data from S3, your logs mist be formatted as either JSONL or CSV format. They cannot be in a JSON array.

If it is possible for your organization, use a third-party software to pre-process your data file before it's sent to S3 (e.g Cribl, Fluentd, etc).