What is the default alert_context if I don't have an alert_context function in my Panther detection?
Last updated: September 3, 2024
QUESTION
What is the default alert_context if I don't have an alert_context function in my Panther detection?
ANSWER
The default is null (an empty Dict)unless you intentionally set it in your rule.
The function alert_context should return a dictionary, as shown in this rule template in Panther's Github and this Okta rule.