QUESTION

When I only updated the CSV file for a Custom Lookup Table (LUT), the Panther Analysis Tool (PAT) output did not reflect the update. However, when I updated the YAML file, it showed as modified. Is this expected?

ANSWER

This is expected—Panther tracks structural changes but handles data updates differently.

When you update the YAML file for a LUT, you're changing its structure and settings. Since these changes affect how Panther processes data, PAT detects them and marks the LUT as modified.

However, the CSV file only contains data, not settings or structure. If you update the CSV, Panther treats it as a data refresh instead of a modification. That’s why the PAT upload summary won’t show it as modified when only the CSV is updated.