QUESTION

I'm writing a custom Python rule, but it generates the following error when evaluating logs, or during unit testing:

TypeError: "method" object is not subscriptable

How can I resolve the error?

ANSWER

This is an error from Python which is generated when you attempt to access a property using square braces [], but the object being accessed is not a dictionary or list.

There can be numerous cases where this mistake can occur, but the most common one in Panther rules is using square braces for event.get instead of round ones. For example, event.get["foo"] will cause an error, but event.get("foo") will not.

To locate the line which is causing the error, search your rule code for square braces [] and determine if you should be using round braces () instead.