Comparing a previous event with a current event to create a Panther detection

QUESTION

How do I use information from a previous event to compare with the current event and create a detection in Panther? How does storing information to compare with a later event in a detection work?

ANSWER

You can store data from your current event in a key:value pair for retrieval when the next event is parsed through your rule. Here are the functions you can use to cache values for use in future events.

First, make sure to import panther_oss_helpers!

Counter Functions:

• get_counter() - Get the latest counter value
• increment_counter() - Add to the counter (default of 1)
• reset_counter() - Reset the counter to 0
• set_key_expiration() - Set the lifetime of the counter

String Functions

• get_string_set() Get the string set's current value
• put_string_set() - Overwrite a string set
• add_to_string_set() Add one or more strings to a set
• remove_from_string_set() - Remove one or more strings from a set
• reset_string_set() - Empty the setGlobal Modules

For more information, check out the Python code for these functions in Panther's Github.