Issue

When uploading a ZIP file through the Bulk Uploader in the Panther Console, you encounter the following error:

new.png

Note that the file path starts with __MACOSX/and the error message is
Could not upload your rules
yaml: control characters are not allowed.

Resolution

To resolve this issue, try zipping the folder from the terminal with one of the following commands:

zip -r panther.zip [directory to zip up here]

or

panther-analysis_tool zip --path [directory to zip up here] --out panther.zip

Cause

This issue occurs when using the native compression feature in Mac's Finder. This compression feature adds a hidden folder called __MACOSX which contains metadata files for the objects in the ZIP file, and those files are incompatible with our YAML parser. Compressing using one of the CLI tools mentioned above forgoes adding this folder.