DynamoDB Error When Bulk Updating Alert Statuses in Panther

Last updated: December 29, 2025

Issue

When attempting to bulk update the status of multiple alerts (e.g., changing from OPEN to TRIAGED status), you may encounter a DynamoDB error message: "operation error DynamoDB: TransactWriteItems, https response error StatusCode: 400 TransactionCanceledException: Transaction cancelled, please refer cancellation reasons for specific reasons [None, TransactionConflict]"

Resolution

To resolve this issue:

  1. If you encounter the DynamoDB error, simply retry the status update operation

  2. The error is recoverable and does not affect the integrity of your alerts

Cause

This issue occurs when multiple concurrent updates are attempted on a single DynamoDB item simultaneously. This can happen when clicking the update button multiple times in rapid succession.

While the error message may appear under the above circumstances, the operation can be safely retried.