How to programmatically update a lookup table in Panther

QUESTION

How do I programmatically update a lookup table? I have some lookup tables that need to be updated very often.

ANSWER

This requires two tasks:

1. Create the lookup tables automatically, for example by writing a script that generates the LUTs in the form of a CSV file.

2. Put the lookup tables in Panther automatically. The best ways to do this are via AWS S3 as documented here, or using GitHub Actions to automate the upload using panther_analysis_tool.

   • Please see a working prototype of an example Github Actions workflow here.