What’s the best way for me to customize Panther-managed global helper functions?
Last updated: January 14, 2026
QUESTION
What’s the best way for me to customize Panther-managed global helper functions?
ANSWER
The best way to customize Panther-managed global helpers depends on whether you manage your content in the Panther Console or via the CLI workflow.
Console workflow
To customize a Panther-managed global helper in the Console workflow:
Clone both the helper and any detection that references it. This way, you’ll have a fully customized version of both.
There is no built-in cloning functionality for Panther-managed helpers in the Panther Console. To clone a managed helper, create a new helper with the same code as the managed version.
See these instructions for how to clone a Panther-managed detection.
Make any desired changes to the cloned helper.
Avoid editing the Panther-managed helper itself in the Panther Console—any changes you make will be overwritten the next time you update the Pack containing the helper.
CLI workflow
There are two approaches to customizing Panther-managed global helpers in the CLI workflow:
Option 1 (recommended): Clone the Panther-managed global helper, i.e., create a copy of the managed global helper and customize it.
This approach allows you to self-manage your custom versions.
Note: You may need to update imports in rules that use these helpers by cloning those rules.
Option 2: Overwrite Panther-managed global helper, i.e., directly modify the managed global helper itself.
This option is not recommended, as it may lead to merge conflicts if Panther updates the same helper in the future
If your global helper changes aren't reflecting, please check out this kb article for more troubleshooting steps.