QUESTION

When crafting a detection which uses the severity()function, how can I test that the function outputs the correct severity each time?

ANSWER

If you test your detections in the Panther Console as described here, any unit test output on which the severity()function has been applied and the severity is not the default one will have the generated severity displayed, as in the picture below.

When the Severity field is not visible in the unit test, this means that the default severity is used.

image.png

A similar behavior is encountered when testing detections using the Panther Analysis Tool:

image.png