When Panther sends an alert, it includes the JSON payload of the data stored in the alert_context. Can I control how this is formatted; for example, could I add indentation to the nested fields of the JSON object?
No, Panther does not support customization of the alert_context
payload.
If you need to perform any formatting or post-processing on alert_context
, we suggest configuring your alert to deliver to a custom webhook, where you can alter the information with a custom script or third-party service, before delivering to your intended final destination.