Automatically convert a Simple Rule to the corresponding Python rule code in Panther
QUESTION
Is there a way to automatically convert a Simple Rule to the corresponding Python rule code in my Panther Console?
ANSWER
Panther does not currently offer a way to automatically convert a Simple Rule to a Python rule, so if you're interested in seeing this feature please reach out to our Support Team.
However, there is a way to see what the generated Python is for the Simple Rule using our REST API. The following details will be required:
- An API token with
View Rules
permissions - The
RuleID
of the aforementioned Simple Rule - The rest endpoint you can hit:
{{yourAPIHost}}/simple-rules/{{RULE_ID_HERE}}?include-python=true
- Here are our Simple Detection REST API docs for more details.
The Python code will be in the pythonBody
object of the response.
Please note that the generated Python code following the above approach may be rather verbose.