Enabling GreyNoise integration for use with Panther Analysis Tool

QUESTION

As mentioned in Panther's documentation, if you use the Panther Analysis Tool for managing detections, you should not enable the GreyNoise pack in the Panther Console. What is the process to enable and start taking advantage of the GreyNoise pack while keeping the existing CI/CD workflows?

ANSWER

As a CI/CD user, you can pull the latest version of panther-analysis to access the GreyNoise Lookup Tables. Just remember that if you make any changes to the LUTs to not enable the packs via the Panther Console as simultaneous use of both the Panther Console and PAT to manage this pack is not supported.

If you keep your own repo, you can copy the files for the Lookup Tables from here:
https://github.com/panther-labs/panther-analysis/tree/master/lookup_tables/greynoise