How do I check if my Panther rules are working?
QUESTION
How do I investigate if my rules are being applied? I did not see alerts trigger as expected.
ANSWER
You can check for rule matches in the Data Explorer with the following query:
SELECT p_rule_id, count(p_rule_id) FROM panther_rule_matches.public.aws_cloudtrail WHERE p_occurs_since('48 hours') GROUP BY p_rule_id
Results will show a list of rule IDs and the number of times they have triggered an alert in the timeframe provided.