Why did my CI/CD run succeed and the "last updated" timestamp changed, but my detection code wasn't applied in Panther?

Last updated: July 3, 2026

QUESTION

I ran panther_analysis_tool upload (or a GitHub Actions CI/CD workflow using PAT), the run completed successfully, and Panther updated the "last updated" timestamp on my detections — but when I check the rule in the Panther Console, the code still reflects the old version. Why didn't my changes apply?

ANSWER

A successful PAT upload exit code and a bumped "last updated" timestamp in Panther confirm that the upload API received your payload — but neither guarantees that the specific rule you edited was included in the upload or that the change was persisted. Work through the following steps to identify the cause.

Step 1: Check the Upload Summary

The most reliable signal is the Upload Summary block at the end of your PAT run output:

Upload Summary
 Rules
  Total: 108
  New: 0
  Modified: 4

  • If Modified: N is lower than the number of rules you edited, Panther didn't register all your changes — continue to Step 2.

  • If Modified: N matches what you expected, the changes were registered correctly — skip to Step 4.

Step 2: Confirm your edits are on the branch the workflow ran against

If your GHA workflow triggers on pushes to a specific branch (e.g. release), check that your edits were merged into that branch before the run triggered. If you used workflow_dispatch to trigger the run manually, GitHub runs the workflow against whichever branch you selected in the UI — which may not be the branch containing your edits. The run will still succeed and the timestamp will still update, but it uploads the stale branch contents.

Step 3: Check for filter or path exclusions

Review the panther_analysis_tool upload command in your workflow YAML for:

  • A --filter flag (e.g. --filter Enabled=true) that may be silently excluding the edited file

  • A --path argument that doesn't cover the directory where your edited file lives

Also confirm the RuleID: field at the top of your YAML exactly matches the rule ID shown in the Panther Console, including casing. If the IDs don't match, PAT may create a new rule rather than update the existing one.

Step 4: Re-run the upload

If Steps 1–3 all check out — the Modified count matched your expectations, the correct branch was used, no exclusions apply, and the RuleID matches — the issue is likely a transient backend processing failure where the upload was received but not persisted. Re-running the upload via a new workflow_dispatch or a local panther_analysis_tool upload will typically resolve this.

If the problem recurs after re-running, please contact Panther Support with the GHA run ID and the timestamp of the original failed run.