This detection, Panther.Detection.Deleted
triggers normally but the AlertContext
fails with a {"_error":"TypeError(\"'NoneType' object is not iterable\")"}
error message.
The Panther engineering team is aware of this issue and investigating a fix. While a timeline is not currently available for this fix, you can send further questions or concerns to Panther's support team.
This issue occurs due to the logic in def alert_context(event):
, more specifically the "deleted_detections_list": [x.get("id") for x in detections_list],
, which tries to iterate through None
type value.
This happens due to lack of input
field in the actionParams
field of the event in this line detections_list = deep_get(event, "actionParams", "input", "detections")
.