Can Panther ingest compressed data?

QUESTION

Am I able to import compressed data, such as ZST formatted files from an S3 bucket? Is it possible to ingest a compressed CSV from S3 into a custom enrichment?

ANSWER

For S3 and GCS transports, Panther supports ingesting compressed data in Gzip and Zstd formats. Please see Ingesting compressed data in Panther for more information.

You can set up a custom enrichment to read from an S3 object, if the S3 object is Gzip compressed.

Panther does not currently support ingesting JSON files compressed using Snappy. A workaround for this would be to create a Lambda function to preprocess the logs before it reaches Panther for ingestion.