QUESTION

Can I use functions like event.lookup() or event.deep_get() inside a Panther Data Model?

ANSWER

No, you cannot. Apart from the event.get() function, all other event object functions will not be available in Data Models (eg. event.lookup() or event.deep_get()).

This is because Data Model methods receive events as ImmutableCaseInsensitiveDict objects rather than `PantherEvent` objects to:

1. Prevent infinite recursion: PantherEvent exposes a udm() method, which is what triggers data model logic. If a data model method received a full PantherEvent, calling event.udm() inside it could re-trigger the same data model, potentially causing infinite recursion

2. Prevent Mutation: Prevent customer data model methods from mutating the shared event, causing cross-contamination between rules.

As a workaround, you can:

• Perform the data enrichment in the detection rule instead of the data model

• Use global helper functions like `deep_get()`, though note that `lookup()` is not available as a global helper function