When is it better to use Simple Detections instead of Python for Panther detections?

QUESTION

Are there any situations or types of detections for which it's better to use the Simple Detection builder than to use Python, or vice versa?

ANSWER

Generally, this depends on the preference of the technician using Panther. For more specific information, please see our documentation here:

• ­Using python vs simple detections yaml
• ­Limitations of simple detections yaml