When trying to set up a CI/CD environment to manage Panther detections, I downloaded my detections from my Panther Console, but there is a different total number of rules in my local collection than in the Panther Console. These totals should match, since I want to continue using the same set of detections, even though I'm using CI/CD instead of the Panther Console.
There are several possible resolutions to this issue:
- Make sure your local repository is configured to receive updates from Panther's public repository.
- Check whether you have custom detections in your Panther Console.
If you have detections in your GitHub but not in your Console, you can likely disregard this issue. Only rules distributed via Packs would show up in the Console, whether they're enabled or disabled, and not all rules are distributed via Packs.
However, if you have detections in your Console but not your GitHub, this is expected if they're custom rules that you built.