Detection Features

Accessing event data fields with a slash ( / ) in the name, using Panther Simple Detections

›

Allowing Panther detection code to access metadata about that detection

›

Are Data Model field name paths in Panther case sensitive?

›

Are there any storage or size limitations to the strings that I can store in a String Set in Panther?

›

Can I export a list of my alerts from Panther?

›

Can I manually edit data stored in the Panther KV Cache?

›

Can I modify a Panther-managed Data Model?

›

Can I omit unused fields from my detection unit test?

›

Can I parse a specific field in my JSON log with a fastmatch or regex log parser in Panther?

›

Can I return a detection triggering event in the alert_context function?

›

Can I share String Sets across different detections in Panther?

›

Can I track the revision history of a rule in the Panther Console?

›

Can I use a list in a Panther detection to send alerts to multiple destinations?

›

Can I use breakpoints and other Python debug tools on Panther detection functions and tests?

›

Can I use multiple AWS roles for accessing secrets from Panther detections?

›

Can I use pytest or other testing frameworks to test helpers used in Panther?

›

Can I view the data stored in the Panther KV cache?

›

Can Panther filter detections based on enrichment data?

›

Can the alert_context function in Panther return a list of values or JSON data?

›

Can we disable Detection Packs from the Panther Console if the "We use the Panther Analysis Tool to manage our detections" setting is enabled?

›

Can you have two different fields going to the same Data Model field in Panther?

›

Comparing a previous event with a current event to create a Panther detection

›

Data Replay for 15GB and 20GB is taking a long time to complete in Panther

›

Do I need to request access to DynamoDB in order to use the Panther-provided cache helper functions?

›

Do Panther's auxiliary functions get called in any specific order?

›

Do summary attributes get stored in the panther_rule_matches database view in Panther?

›

Does DynamoDB in Panther have a default TTL for its cache when one is not explicitly set?

›

Does Panther allow showing MITRE coverage for an arbitrary grouping of detections?

›

Does Panther support the ability to assign users from within a rule detection?

›

How can I access my own AWS resources from my Python Detections? Can I store secrets in Panther?

›

How can I control Panther's deduplication period from within my detection code?

›

How can I export the mappings from Panther’s MITRE ATT&CK page?

›

How can I rerun a rule in Panther?

›

How can I setup a Panther detection such that each event gets sent as its own separate alert?

›

How can I share global data between Python functions in my Panther detection code?

›

How can I use boto3 in Panther detections?

›

How can I write unit tests for Panther detections that use relative time?

›

How deduplication and threshold work in Panther

›

How do I capture stdout in Panther detections?

›

How do I debug a slow performance in the cache or panther-kv-store?

›

How do I include a detailed description with a Panther alert?

›

How do I override my Panther detection's default severity?

›

How do I resolve "read timeout on endpoint URL" during a bulk upload to Panther?

›

How do I resolve Data Replay time range errors in my Panther Console?

›

How do I resolve the error "only one LogType may be specified per DataModel" while uploading a Data Model to Panther?

›

How do I return an array of values from a Mock in a Panther detection?

›

How do I set up my Panther alert to be dynamically generated in order to provide the most context?

›

How do I set up separate destinations for detections with the same log type?

›

How do I use deep_get() to get a value from a nested array?

›

How does Panther handle alert deduplication if rules share the same dedup string and dedup period?

›

How to create a link to Search from a Panther detection and include it in alerts

›

How to create scheduled tests for Panther detections

›

How to identify patterns across events within a specified time window in a Panther detection

›

How to measure performance of Panther detections

›

How to open a Panther Console tab in a new browser tab

›

How to prevent Panther from persisting my rule's global variable between log events

›

How to resolve "PantherError: a data model hasn't been specified for this log type".

›

How to test with mocks when a Panther detection sorts cached values

›

How to troubleshoot ModuleNotFound error in Panther detection

›

How to write unit tests for stateful Panther detections

›

In a detection test, is it possible to mock the response of a helper function that is not directly called in my detection code?

›

In a Panther detection, does set_key_expiration immediately clear the cache once the key is expired?

›

Is it possible to include nested fields in my Panther detection filters?

›

Is there a time or size limit on the Panther Data Replay feature?

›

Is there an advantage to using Filters instead of code in Panther detections?

›

List and dict type comparisons aren't working in my Panther detection

›

Maximum number of minutes to use for DedupPeriodMinutes in a Panther detection

›

My Panther analysis cache was not cleared by the set_key_expiration function

›

Panther.Detection.Deleted fires with a broken AlertContext

›

Retrieving nested data values with deep_get for a Panther Detection

›

What does Managed or Unmanaged mean for a detection in the Panther Console?

›

What does the title function return if there are no changes in its body, or if the function is not included in a Panther detection?

›

What fields are used for deduplicating repeated alerts in Panther?

›

What happens when I change the deduplication string of a Panther rule?

›

What is the default alert_context if I don't have an alert_context function in my Panther detection?

›

What is the difference between get and deep_get when writing detections in Panther?

›

What is the recommended way to do exception handling with Panther Detections?

›

What's the difference between a Fail and an Error error state in Panther's detection unit testing?

›

What's the difference between p_udm and event.udm in Panther?

›

What's the meaning of each enriched timestamp field in my alerts on Panther?

›

When is it better to use Simple Detections instead of Python for Panther detections?

›

Where in my Panther code repository can I store my YAML-only detections?

›

Why are the MITRE technique statuses "Partially Covered" in Panther?

›

Why do I receive rule import errors after removing helper functions from my Panther detection?

›

Why is my Panther detection triggering more alerts than specified in my deduplication period and threshold setup?

›

Why is my PAT uploaded detection not appearing in the Destination Override field?

›

Why is oss helpers not accessible when running a Data Replay in Panther?

›

Troubleshooting guide for Panther Detection Inline Filters

›

Is there a way to list all the detections in Panther that weren't created in the Panther Console?

›

Why aren't my Global Helper changes reflected in Panther?

›

Why does Data Replay keep failing on alert simulation in Panther?

›

Why is the Data Replay section not visible for my Detection?

›

My Panther schema is not appearing as a selection on my detection configuration

›

How can I create a detection Inline Filter on a field with dot notation?

›

What’s the best way for me to customize Panther-managed global helper functions?

›

How do I create a detection rule for domain IOCs using p_any_domain_names in Panther?

›

How do I use SummaryAttributes in Panther correlation rules?

›

Why can't I select the most recent date when configuring a Data Replay in Panther?

›

Can the high-volume alert creation threshold be changed in Panther, and how should I handle noisy detections?

›