diff --git a/panther_analysis_tool/detection_schemas/analysis_config_schema.json b/panther_analysis_tool/detection_schemas/analysis_config_schema.json index 8531637f..aa40ce52 100644 --- a/panther_analysis_tool/detection_schemas/analysis_config_schema.json +++ b/panther_analysis_tool/detection_schemas/analysis_config_schema.json @@ -1546,6 +1546,9 @@ "Query": { "type": "string" }, + "PantherFlowQuery": { + "type": "string" + }, "QueryName": { "type": "string" }, diff --git a/panther_analysis_tool/schemas.py b/panther_analysis_tool/schemas.py index 5d459bc9..73d785db 100644 --- a/panther_analysis_tool/schemas.py +++ b/panther_analysis_tool/schemas.py @@ -262,7 +262,7 @@ def validate( { "AnalysisType": Or("saved_query"), "QueryName": And(str, NAME_ID_VALIDATION_REGEX), - Or("Query", "AthenaQuery", "SnowflakeQuery"): str, + Or("Query", "AthenaQuery", "SnowflakeQuery", "PantherFlowQuery"): str, Optional("Description"): str, Optional("Tags"): [str], Optional("Lookback"): bool, diff --git a/tests/unit/panther_analysis_tool/test_schemas.py b/tests/unit/panther_analysis_tool/test_schemas.py index 6fac1c3d..14130099 100644 --- a/tests/unit/panther_analysis_tool/test_schemas.py +++ b/tests/unit/panther_analysis_tool/test_schemas.py @@ -337,6 +337,15 @@ def test_saved_query_validate_schema(self): "Query": "select 1", } ) + + # allows PantherFlow + SAVED_QUERY_SCHEMA.validate( + { + "QueryName": "my.query.id", + "AnalysisType": "saved_query", + "PantherFlowQuery": "// test", + } + ) # missing QueryName with self.assertRaises(SchemaError): SAVED_QUERY_SCHEMA.validate(