QUESTION

Does field discovery automatically add the new fields to my schema YAML file in Panther?

ANSWER

Field discovery will add the discovered fields as "discovered" in the graphic view of the schema if you don't see them, make sure to click the "Show Discovered Fields" button. The "discovered" fields can be successfully used in database queries and detections.

Please note that the "discovered" fields will not be automatically included in the schema YAML raw code representation</>. You will also need to manually edit your schema to include the fields.

Screenshot 2023-09-28 at 7.43.54 AM.pngScreenshot 2023-09-28 at 7.47.56 AM.png