Issue

After syncing to the latest version of the panther-analysis repo, I am getting the error message 

ImportError: cannot import name 'Draft202012Validator' from 'jsonschema.validators'when performing unit tests.

Resolution

To resolve this issue, please start by performing the following verifications:

  1. Confirm that you are using the most recent version of PAT.

  2. Check if you are utilizing PAT as a global dependency or via pipenv within panther-analysis.

If you are using PAT as a global dependency, then we recommend utilizing pipenv when using panther_analysis_tool to avoid dependency problems. The steps below can be used to accomplish this:

  1. Navigate to your panther-analysis fork

  2. Run make install

  3. Run pipenv shell

  4. Run pipenv run panther_analysis_tool {command}

    • Replace {command} with the relevant command. For example, Run unit tests against detection rules.

Cause

You are running into this problem because you are utilizing a global version of PAT which would require you to manually install missing dependencies instead of getting all the relevant dependencies you need via pipenv. Doing a global install can cause dependency problems and we usually recommend utilizing pipenv to avoid dependency issues.