Best practices for handling IP allowlists with Panther custom enrichments

QUESTION

 How do I handle IP allowlists in Panther with custom enrichments?

ANSWER

 We recommend the following best practices when working with IP allowlists:

• If the allowlist is generally static and does not change often, use a global list or dictionary.

  • See this page for a code example.

• If the allowlist is generally static but you want to include additional information about the IP, upload a file for a custom enrichment.

• If the allowlist changes or you have a lot of extra data you want to include as part of the lookup, sync your custom enrichment data using an S3 bucket.