When trying to ingest a log source in Panther, I'm getting a classification error that returns empty:
To resolve this issue:
- Please check if your log source contains multiple CSV schemas. If so, please edit and add the
columnsfields for the CSV schemas.
This issue occurs when a log source has multiple CSV schemas without the
columns field. Panther requires the
columns fields to differentiate between logs.