When uploading a ZIP file through the Bulk Uploader in the Panther Console, you encounter the following error:
Note that the file path starts with __MACOSX/
and the error message isCould not upload your rules
yaml: control characters are not allowed
.
To resolve this issue, try zipping the folder from the terminal with one of the following commands:
zip -r panther.zip [directory to zip up here]
or
panther-analysis_tool zip --path [directory to zip up here] --out panther.zip
This issue occurs when using the native compression feature in Mac's Finder. This compression feature adds a hidden folder called __MACOSX
which contains metadata files for the objects in the ZIP file, and those files are incompatible with our YAML parser. Compressing using one of the CLI tools mentioned above forgoes adding this folder.