QUESTION

Why do I get a SQL compilation error with an "invalid identifier" when selecting a column like account in the Data Explorer, even though the field exists in my schema and SELECT * returns results correctly?

ANSWER

Keywords like ACCOUNT is a reserved keyword in Snowflake, the underlying data platform Panther uses. When you reference it as an unquoted column name in a SELECT list, Snowflake's SQL compiler treats it as a keyword rather than a column identifier, causing a compilation error. This is why SELECT * works (no explicit identifier parsing) while SELECT region, account, timestamp fails.

There are two ways to resolve this:

Option 1 – Wrap the column name in double quotes (quick fix)

Enclose account in double quotes in your query to force Snowflake to treat it as a column identifier:

SELECT
    region,
    "account",
    timestamp
FROM panther_logs.public.custom_prod_aws_cwlogs
WHERE p_occurs_since('10 d')
LIMIT 2

Option 2 – Rename the field in your custom schema (permanent fix)

Rename the account field in your custom log schema to a non-reserved name, such as aws_account_id. This avoids the quoting requirement in all future queries and in any rules or detections that reference the field. Note that any existing saved queries or detections referencing the old field name will need to be updated accordingly (e.g. Detection rules, PantherFlow correlation rules, and any saved Data Explorer queries).