How can I setup a Panther detection such that each event gets sent as its own separate alert?

QUESTION

How do I disable deduplication for my Panther detections? I want each event to be sent as a single alert.

To setup a detection that will send a separate alert for each incoming event:

Log in to the Panther Console.
Go to Build > Detections. Select the Detection you would like to edit. Click Edit.
Set the Deduplication Period low.
- This is how long Panther will wait to group events together. Since you don't want alerts grouped, you can use the lowest setting here.
Set the Events Threshold to 1.
- This is how many events Panther will attempt to group together.
In the Functions and Tests tab, you can edit your Python code and add a def dedup(event): function. The return value of this function should be a string that will be used as a key that tells Panther which events to group together. If you don't want any events to be grouped together, then you will want the return value of this function to be something unique, such as a UUID of the event itself, or potentially a timestamp of the current time. See here in our docs for more details on deduplication.