# Simple Detection Error Codes

## Overview

Error codes from the [Simple Detections](https://docs.panther.com/detections/..#simple-detections) model are stable, meaning they do not change over time and are formatted consistently.

Error codes have 10 characters, and each character group represents something different. To demonstrate this, take the error code `SD00100001`. It is broken down as follows:

* First and second characters: Always `SD`
* Third, fourth, and fifth characters: Represent the category: `001` - general
* Sixth through tenth characters: Unique error code: `00001` - no rule specified

## 001 errors: general

<table><thead><tr><th width="210">Error code</th><th>Description</th></tr></thead><tbody><tr><td>SD00100001</td><td><p>This error code is returned when a rule is not specified in the provided Simple Detections YAML. For example, if a Simple Detections YAML file has a top level key of <code>Detection</code> but there's no content under it.</p><pre class="language-yaml"><code class="lang-yaml">AnalysisType: rule
RuleID: Test.MultiMatch.Key
DisplayName: a simple test of Multi-key match expressions
Severity: High
Enabled: true
LogTypes: 
  - Panther.Audit
Detection:
</code></pre></td></tr><tr><td>SD00100002</td><td>This error code is returned when a file could not be read at the specified path.</td></tr><tr><td>SD00100003</td><td>This error code is returned when an unexpected type is encountered. This usually happens when you try to use a <code>Condition</code> like <code>IsLessThanOrEquals</code> with a non-numeric value.</td></tr><tr><td>SD00100004</td><td>This error code is returned when a <code>Condition</code> expected an integer value but got something else.</td></tr><tr><td>SD00100005</td><td>This error code is returned when a <code>Condition</code> expected a float value but got something else.</td></tr><tr><td>SD00100006</td><td>This error code is returned when a <code>Condition</code> expected a boolean value but got something else.</td></tr><tr><td>SD00100007</td><td>This error code is returned when a <code>Condition</code> expected a string value but got something else.</td></tr></tbody></table>

## 002 errors: unmarshaler

<table><thead><tr><th width="215">Error code</th><th>Description</th></tr></thead><tbody><tr><td>SD00200001</td><td>This error code is returned when a YAML file could not be unmarshaled. This most often occurs when the YAML file is malformed.</td></tr><tr><td>SD00200002</td><td>This error code is returned when a YAML node could not be unmarshaled. This most often occurs when the <code>Condition</code> is invalid or the <a href="match-expression">match expression</a> is malformed.</td></tr><tr><td>SD00200003</td><td><p>This error code is returned when the <a href="../match-expression#key-specifiers">key specifier</a> is invalid. This occurs when:</p><ul><li>A <a href="../match-expression#multi-key-match-expressions">multi-key match expression</a> has a malformed entry under the <code>Values</code> key:</li></ul><pre class="language-yaml"><code class="lang-yaml">- Condition: Equals
  Values:
    # This first list element is invalid. It cannot have both Key and KeyPath. 
    - Key: abc
      KeyPath: a.b.c
    - Key: def
</code></pre><ul><li>A <a href="..#groupby"><code>GroupBy</code></a> statement has a malformed entry under the <code>GroupBy</code> key:</li></ul><pre class="language-yaml"><code class="lang-yaml">GroupBy:
  # This first list element is invalid. It cannot have both Key and KeyPath.
  - Key: abc
    KeyPath: a.b.c
  - Key: def
</code></pre><ul><li>An <a href="..#alertcontext"><code>AlertContext</code></a> has a malformed entry in the <code>Value</code> that specifies which key's context to capture:</li></ul><pre class="language-yaml"><code class="lang-yaml">AlertContext:
  - Key: my.alert.context.key
  # The following Value field is invalid - you can only specify a single Key Specifier (Key, DeepKey, or KeyPath)
  Value:
    Key: p_any_ip_addresses
    KeyPath: p_any_ip_addresses
</code></pre></td></tr><tr><td>SD00200004</td><td><p>This error code is returned when the YAML match expression for an existence <code>Condition</code> is malformed. Usually, this occurs when a <code>Value</code> or <code>Values</code> key is specified in the YAML:</p><pre class="language-yaml"><code class="lang-yaml">- Key: abc
  Condition: Exists
  Value: someInvalidString # This Value key is invalid.
</code></pre></td></tr><tr><td>SD00200005</td><td><p>This error code is returned when, after we finish unmarshaling the YAML, the resulting struct is invalid. Simple Detections runs a number of validations at this stage, including:</p><ul><li>Validation that the specified <a href="../match-expression#key-specifiers">key specifier</a> format is correct</li><li>Validation that absolute Conditions (<code>AlwaysTrue</code>, <code>AlwaysFalse</code>) are only used with <a href="../match-expression#absolute-match-expressions">absolute match expressions</a></li><li>Validation that a specified <code>KeyPath</code> is using valid syntax</li><li>Validation that a specified <code>Key</code> is using valid syntax</li></ul></td></tr></tbody></table>

## 003 errors: core

<table><thead><tr><th width="217">Error code</th><th>Description</th></tr></thead><tbody><tr><td>SD00300001</td><td>This error is returned when a Simple Detection Rule Data Model could not be created. Most commonly, this will be a catch all for less specific errors. Check the "Inner Error" for additional details.</td></tr><tr><td>SD00300002</td><td>This error is returned when a Simple Detection Filter Data Model could not be created. Most commonly, this will be a catch all for less specific errors. Check the "Inner Error" for additional details.</td></tr><tr><td>SD00300003</td><td>This error is returned when Simple Detections was able to unmarshal the provided YAML but was unable to create a valid Simple Detections data model. This error should rarely occur, but if it does, it is likely due to a bug in the Simple Detections data models.</td></tr><tr><td>SD00300004</td><td><p>This error is returned when Simple Detections was able to create a valid Simple Detections data model but was unable to validate the constructed <a href="match-expression">match expression</a>. Validations that are run on constructed match expressions include, by type:</p><ul><li><p>Existence conditions:</p><ul><li>only a <a href="../match-expression#key-specifiers">key specifier</a> and <code>Condition</code> are provided</li></ul></li><li><p>Absolute conditions:</p><ul><li>only a <code>Condition</code> is provided</li></ul></li><li><p>Scalar conditions:</p><ul><li>a <a href="../match-expression#key-specifiers">key specifier</a>, <code>Condition,</code> and <code>Value</code> are provided</li></ul></li><li><p>List conditions:</p><ul><li>a <a href="../match-expression#key-specifiers">key specifier</a>, <code>Condition</code>, and <code>Values</code> are provided</li></ul></li><li><p><a href="../match-expression#multi-key-match-expressions">Multi-key match expressions</a>:</p><ul><li><code>Condition</code> and <code>Values</code> are provided</li></ul></li><li><p>List comprehension conditions:</p><ul><li>a <a href="../match-expression#key-specifiers">key specifier</a>, <code>Condition</code>, and <code>Expressions</code> are provided</li><li><p><code>Expressions</code> contains:</p><ul><li>One or more nested list comprehensions, i.e., a list comprehension calling another list comprehension</li><li>One or more simpler (i.e., not list comprehension) match expressions</li></ul></li></ul></li></ul></td></tr><tr><td>SD00300005</td><td><p>This error code is returned when Simple Detections was able to create a valid Simple Detections data model but was unable to validate the <a href="..#groupby"><code>GroupBy</code></a> statement. Validations that are run on the <code>GroupBy</code> statement include:</p><ul><li>At least one <a href="../match-expression#key-specifiers">key specifier</a> is provided</li></ul></td></tr><tr><td>SD00300006</td><td>This error code is returned when a Simple Detection <code>GroupBy</code> Data Model could not be created. Most commonly, this will be a catch all for less specific errors. Check the "Inner Error" for additional details.</td></tr><tr><td>SD00300007</td><td><p>This error code is returned when a Match Expression was expected to be a <a href="../match-expression#list-comprehension-match-expressions">list comprehension</a> but is not a list comprehension. This is most commonly returned when:</p><ul><li><p>A dynamic severity is specified</p><ul><li>List comprehensions are not allowed in <a href="..#dynamicseverities"><code>DynamicSeverities</code></a></li></ul></li><li><p>A list comprehension is attempted to be used in an <a href="../../inline-filters#creating-filters-in-the-developer-workflow">Inline Filter</a></p><ul><li>List comprehensions are not allowed in <code>InlineFilters</code></li></ul></li></ul></td></tr><tr><td>SD00300008</td><td>This error code is returned when a Simple Detection Alert Context Data Model could not be created. Most commonly, this will be a catch all for less specific errors. Check the "Inner Error" for additional details.</td></tr><tr><td>SD00300009</td><td><p>This error code is returned when Simple Detections was able to create a valid Simple Detections data model but was unable to validate the <a href="..#alertcontext"><code>AlertContext</code></a> statement. Validations that are run on the <code>AlertContext</code> statement include:</p><ul><li>A minimum of one (1) key/value pair is provided if <code>AlertContext</code> is specified</li></ul></td></tr><tr><td>SD00300010</td><td><p>This error code is returned when Simple Detections was unable to validate the provided <code>AlertTitle</code>. Validations that are run on the <code>AlertTitle</code> include:</p><ul><li>The <code>AlertTitle</code> is not empty</li></ul></td></tr><tr><td>SD00300011</td><td>This error code is returned when a Simple Detection <code>AlertTitle</code> Data Model could not be created. Most commonly, this will be a catch all for less specific errors. Check the "Inner Error" for additional details.</td></tr><tr><td>SD00300012</td><td>This error code is returned when a Simple Detection Dynamic Severities Data Model could not be created. Most commonly, this will be a catch all for less specific errors. Check the "Inner Error" for additional details.</td></tr><tr><td>SD00300013</td><td><p>This error code is returned when a Dynamic Severity is specified but has no conditions:</p><pre class="language-yaml"><code class="lang-yaml">DynamicSeverities: 
  - ChangeTo: CRITICAL
    Conditions: []
</code></pre></td></tr><tr><td>SD00300014</td><td><p>This error code is returned when Simple Detections was able to create the Dynamic Severities Data Model, but was unable to validate it. Validations that are run on the Dynamic Severities include:</p><ul><li>If <code>DynamicSeverities</code> is specified, at least one Dynamic Severity is specified</li><li>No list comprehensions are used in the <code>Conditions</code></li><li>No <a href="../match-expression#combinators">combinators</a> are used in the <code>Conditions</code> (e.g. <code>Any</code>, <code>All</code>, <code>OnlyOne</code>, <code>None</code>)</li><li>No Absolute Conditions are used in the <code>Conditions</code></li><li>No <a href="../match-expression#multi-key-match-expressions">multi-key match expressions</a> are used in the <code>Conditions</code></li></ul></td></tr></tbody></table>

## 004 errors: transpiler

<table><thead><tr><th width="219">Error code</th><th>Description</th></tr></thead><tbody><tr><td>SD00400001</td><td>This error code is returned when a <a href="match-expression">match expression</a> could not be converted to Python. See the "Inner Error" for additional details.</td></tr><tr><td>SD00400002</td><td>This error code is returned when a <a href="match-expression">match expression</a> could not be converted to a Python comment. This is unlikely to occur and is probably a bug in Simple Detections.</td></tr><tr><td>SD00400003</td><td>This error code is returned when Simple Detections was able to convert all of the <a href="match-expression">match expressions</a> under the <code>Detection</code> key into Python, but was unable to construct the full Python rule. This is unlikely to occur and is probably a bug in Simple Detections.</td></tr><tr><td>SD00400004</td><td>This error code is returned when a Match Expression is not yet supported for transpilation to Python. This is unlikely to occur and is probably a bug in Simple Detections.</td></tr><tr><td>SD00400013</td><td>This error code is returned when a Correlation rule could not be converted properly.<br>Only relevant to <a href="../../correlation-rules">Correlations Detections</a>.</td></tr></tbody></table>

## 005 errors: filters

<table><thead><tr><th width="220">Error code</th><th>Description</th></tr></thead><tbody><tr><td>SD00500001</td><td><p>This error code is returned when a <a href="match-expression">match expression</a> could not be converted to an <a href="../inline-filters">Inline Filter</a>. See the "Inner Error" for additional details. Most commonly, this occurs when the provided Match Expression uses an unsupported Match Expression form or <code>Condition</code> for Inline Filters.</p><p>Inline Filters only support the following conditions:</p><ul><li><code>Equals</code></li><li><code>DoesNotEqual</code></li><li><code>IsGreaterThan</code></li><li><code>IsGreaterThanOrEquals</code></li><li><code>IsLessThan</code></li><li><code>IsLessThanOrEquals</code></li><li><code>Contains</code></li><li><code>DoesNotContain</code></li><li><code>StartsWith</code></li><li><code>EndsWith</code></li><li><code>IsIPAddressInCIDR</code></li><li><code>IsIPAddressNotInCIDR</code></li><li><code>CIDRContainsIPAddresses</code></li><li><code>CIDRDoesNotContainIPAddresses</code></li><li><code>IsIn</code></li><li><code>IsNotIn</code></li><li><code>IsIPAddressPublic</code></li><li><code>IsIPAddressPrivate</code></li><li><code>IsNullOrEmpty</code></li><li><code>IsNotNullOrEmpty</code></li></ul><p>Inline Filters only support the following Match Expression forms:</p><ul><li><a href="../match-expression#key-value-match-expressions">Key/value</a></li><li><a href="../match-expression#key-values-match-expressions">Key/values</a></li><li><a href="../match-expression#existence-match-expressions">Existence</a></li></ul></td></tr><tr><td>SD00500002</td><td>This error code is returned when a <a href="../inline-filters">Inline Filter</a> could not be converted to a <a href="match-expression">match expression</a>. This is unlikely to occur and is probably a bug in Simple Detections.</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/detections/rules/writing-simple-detections/simple-detection-error-codes.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.