Panther Analysis Tool error when uploading tests: cannot unmarshal map or seq into string

Last updated
Save as PDF

Issue

When trying to upload a detection along with its mocks, I see an unmarshalling error like the following:

[INFO]: Uploading items to Panther
[ERROR]: failed to upload to backend: {'statusCode': 400, 'headers': {}, 'multiValueHeaders': {}, 'body': '{"issues":[{"path":"custom_detection.yml","errorMessage":"yaml: unmarshal errors:\\n  line 42: cannot unmarshal !!seq into string\\n  line 64: cannot unmarshal !!map into string"}]}'}

The tests pass with no problem; the issue is, the upload to Panther fails.

Resolution

To resolve this issue, make sure your mock's returnValue is wrapped in a string. This can be done in multiple ways, including the following:

1. Add >- (a greater-than sign, and a dash/minus sign) at the beginning of the value of returnValue like this:

Mocks:
    - objectName: get_string_set
      returnValue: >-
                   [
                      'string-1', 
                      'string-2', 
                      'string-3',
                      ...

2. Put a double-quote at the beginning and end of the value of returnValue like this:

Mocks:
      - objectName: get_string_set
        returnValue: "[ 'string-1', 'string-2', 'string-3', 'string-4']"

Cause

This issue occurs when a mock's returnValue is not a string.