Why does my ingested event name field contain the word "slash" instead of the "/" in link names in Panther?

QUESTION

Some of my ingested events have field names that contain links. When I view these in the Panther Console, how come the links say "slash" instead of containing the character "/"?

Screen Shot 2022-11-17 at 10.29.18 AM.png

ANSWER

Panther replaces certain characters in field names to become valid identifiers in the data lake. This makes it possible to query altogether.

Snowflake allows special characters in identifiers only if you wrap the field name in quotes.