QUESTION

Hey team, uploads via the CI/CD pipeline started failing with this error, and im not sure how to fix it:

-----
Path: anomalous_vpc_port_activity_query.yml
Error: failed to save query "VPC Flow Port Scanning": 002003 (42S02): SQL compilation error:
Object 'PANTHER_LOGS.PUBLIC.AWS_VPCFLOW' does not exist or not authorized.
-----

ANSWER

This issue typically arises when the specified table in the PANTHER_LOGS.PUBLIC.* database is either missing, have not yet received any ingested data, or your user lacks the necessary permissions to access it.

To troubleshoot this:

• Check if the tables exist. Navigate to Investigate > Data Explorer in Panther and verify that the table appears in the dropdown list.

• Check if the table have data ingested. Run a sample query (replacing <your_table_name> with the actual table name) to confirm if any data exists:

  SELECT *
  FROM
  panther_logs.public.<your_table_name>
  LIMIT 10

• Ensure you're using an API token for your CI/CD upload, and that the token was created by a user with sufficient permissions to query the database.

If you're encountering a similar issue with the PANTHER_LOOKUPS.PUBLIC.* database, please refer to this knowledge base article for more details.