What happens when Panther ingests a required data field whose value is null?
If the value of a required data field is null, then the log event that contains that value will fail to classify. Values in required fields must be non-null in order to classify successfully.
For more information about custom schemas, see Panther's documentation here.