When trying to using panther_analysis_tool (PAT) to test my detections locally, I'm getting the following error:
AttributeError: 'PantherEvent' object has no attribute 'deep_walk'
Most likely, one of your dependencies (
panther-core) is out of date. To resolve this issue:
- (If using a virtual environment): Activate your virtual environment by cd-ing into your Panther repo, then running
- Explicitly update panther core by running
python3 -m pip install panther-core --upgrade
deep_walk function was added to Panther events in
panther-core version 0.6.3. If you have an outdated version, then any rules which have syntax like
def rule(event): actor = event.deep_walk('parameters', 'actor') ...
will cause errors.