QUESTION

Are the _history tables deprecated now in Panther lookup tables? When uploading new lookup tables, the old ones don't appear as _history tables anymore.

ANSWER

Yes, as of Panther version 1.117, support for historical tables in the panther_lookups.public database has been discontinued.

Tables like <lookupname>_XXX, <lookupname>_history_XXX, and <lookupname>_history stopped being populated and only the table containing the most up-to-date lookup data in <lookupname> will now be populated.

If you were referencing these historical tables aiming to know how a log event was enriched while being processed by detections, kindly note that signals contain enrichment data.