“Object… does not exist or not authorized” error when querying enrichment providers in Panther

ISSUE

I tried to run a query on an enrichment provider Lookup Table and the following error occurred:

279001: 01aa0dc9-0602-f8dc-004a-1e030bb718fe: server ErrorCode=002003, ErrorMessage=SQL compilation error: Object 'PANTHER_LOOKUPS.PUBLIC.IPINFO_ASN_DATALAKE' does not exist or not authorized.

The example error above references IPinfo, but a similar error can also occur for TOR exit nodes and other enrichment providers.

RESOLUTION

The enrichment lookup tables (enrichment provider) are included within the relevant Pack.

Perform the checks below to ensure that this Pack is enabled on your instance.

• Navigate to Detections > Packs and ensure the IPInfo Pack is enabled and updated to the latest version

• Navigate to Configure > Enrichment Providers and ensure that the IPinfo Lookup Table that you wish to query is enabled. If not, you can enable it by clicking on the 3 dots icon.

Now the Lookup Table will be enabled, but you will still not be able to query it since it needs first to get some data. After your Lookup table enriches some of your newly ingested data, the table will be generated in the Data Lake, and you will be able to run your queries.
 

CAUSE

This error can occur if the Packs are not enabled in the Panther Console.