Skip to main content
Panther Knowledge Base

Error message "not in list of valid keys" when running tests with PAT

  1. Last updated
  2. Save as PDF

Issue

When trying to execute tests in PAT, the following error message is returned:

'...', '..' not in list of valid keys: ['AnalysisType', 'Enabled', 'Filename', 'RuleID', Or('LogTypes', 'ScheduledQueries'), 'Severity', Optional('Description'), Optional('DedupPeriodMinutes'), Optional('DisplayName'), Optional('OutputIds'), Optional('Reference'), Optional('Runbook'), Optional('SummaryAttributes'), Optional('Suppressions'), Optional('Threshold'), Optional('Tags'), Optional('Reports'), Optional('Tests')]

The yaml we have in place with the rule includes some additional attributes compared to the standard format, causing the pipeline to fail. Is there a way to bypass this error message?

Resolution

To resolve this issue, you can try adding the argument --ignore-extra-keys True to your test command. This argument is meant for advanced users and allows skipping of extra keys.

Please also check that you have updated to the latest version of the panther-analysis-tool.

Cause

This issue occurs when the YAML file of the rule includes some additional attributes compared to the standard format. PAT does not recognize these attributes and returns the error message presented above.