How do I create a Panther alert or scheduled query based on baseline metrics?

QUESTION

How do I create a baseline of metrics and then create an alert or scheduled query that can compare metrics from a time window against the baseline to decide when to run the alert? I want to monitor if certain events, like failed logins, exceed a certain threshold.

ANSWER

Set the desired threshold in a Scheduled Query, and then set up a Scheduled Rule based on that query.

To schedule a query, see Panther's documentation: How to create a scheduled query.

The query should include a variable that you will use in the Scheduled Rule. In the example below, we use the variable failed_logins.

SELECT * FROM
(SELECT COUNT(eventType) as failed_logins 
FROM panther_logs.earnin 
WHERE eventType='failed-login' 
AND p_occurs_since('30 days')) 
WHERE failed_logins > 5;

Now that the Scheduled Query has been saved, go to the Detections section in the Panther Console to create a Scheduled Rule. In the Functions and Tests section for this new rule, you can use the variable from your Scheduled Query. This example uses failed_logins: 

def rule(event):
 if event.get('failed_logins') > 20:
 return True
 return False

def title(event):
 return 'More than 20 failed logins in the last 30 days'