Skip to main content
Panther Knowledge Base

Why does Panther enrichment have an empty dictionary for my log event?


I set up an enrichment source in Panther, but my event(s) have an empty p_enrichment field: {} 


Note: If p_enrichment is null, please see this article: Why is p_enrichment null in my Panther event?

 An empty p_enrichment field can be due to a few things. Please check the following:

  • Is the enrichment source (GreyNoise or Lookup Table) set up to use the log type the event came from?
  • In the enrichment source configuration, is the selector (Log Attribute) defined properly? Note that if the field is nested in a JSON object, the selector must start with $..
    • For example, if you want event['client']['ip'], you need to write $.client.ip.
  • Does the selector value in the event have an entry in the enrichment source?

If you've checked the above, and still can't figure out why it's not working, please reach out to our support team. In your ticket, include:

  1. The answers (yes or no) to each of the points above.
  2. A copy of the event not being enriched.
  3. A copy of the Lookup Table, if possible.
  • Was this article helpful?