A collection of built-in detection rules and policies for Panther, a modern SIEM, enabling security monitoring as code.
Panther Analysis is the official repository of built-in detection rules and policies for the Panther SIEM platform. It provides a library of security logic written as code to analyze logs, scan cloud resources, and detect threats. This enables security teams to implement, customize, and deploy detections programmatically within their Panther deployment.
Security engineers, SOC analysts, and DevOps teams using Panther for security monitoring who need pre-built, customizable detection content and a framework for managing detections as code.
It offers a robust, community-vetted library of security detections that integrate seamlessly with Panther, reducing the time to value for threat detection and enabling teams to adopt a modern, code-driven security operations workflow.
Built-in Panther detection rules and policies
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The repository includes hundreds of rules for services like AWS CloudTrail and Okta, enabling quick threat detection deployment. Evidence: README shows example rules in folders like 'rules/aws_cloudtrail_rules/' and 'okta_brute_force_logins'.
Supports version control, automated testing with panther_analysis_tool, and CI/CD integration for security logic. README details testing, zipping, and uploading via CLI commands.
Curated contributions from Panther Labs and open-source ensure vetted detections, with processes for pulling upstream changes. README includes contributing guidelines and syncing instructions.
Detections can be linked to frameworks like CIS and MITRE ATT&CK, aiding in compliance reporting. README mentions 'Reports' for tracking multiple frameworks.
Tightly coupled with Panther SIEM; detections cannot be used or ported to other security tools without significant rework, as implied by the need for Panther deployment and API integration.
Setting up requires multiple steps: Python virtual environments with pipenv, Docker, pre-commit hooks, and VSCode configuration, which can be daunting for new users. README details extensive setup commands.
Global helpers have a hard-coded location that cannot change, restricting how shared code is organized. README explicitly states: 'This is a hard coded location and cannot change.'