Best practices for handling IP allowlists with Panther Lookup Tables

QUESTION

 How do I handle IP allowlists in Panther with Lookup Tables?

ANSWER

 We recommend the following best practices when working with IP allowlists:

• If the allowlist is generally static and does not change often, use a global list or dictionary.

  • See this page for a code example.

• If the allowlist is generally static but you want to include additional information about the IP, upload a file for a Lookup Table.

• If the allowlist changes or you have a lot of extra data you want to include as part of the lookup, sync your Lookup Table data using S3.