Panther detection.py

def rule(event): return event.get('eventName') == '<x>'

Write Python detections on Panther (the cloud-native SIEM) that analyze CloudTrail, GuardDuty, and cloud sources.

Use it when you want cloud detections with programmatic logic: Panther runs Python functions (rule, dedup, title, alert_context) on each event from connected sources (CloudTrail, GuardDuty, Okta, S3, etc.), and the detection can do what a query cannot: complex conditional logic, correlation with external data (lookups), and enriched alert context. The minimal rule in the example (eventName == '<x>') is extended with conditions on the user, IP, or resource. It's the way to detect what's specific to your environment — the API call nobody uses, the role appearing where it shouldn't — with Python's flexibility and deployment as code.

Don't use it for what a simple query solves: if the detection is a filter on one field, Panther supports declarative rules (or the query in the data lake) that are cheaper to maintain than a function. Poorly written Python logic (unhandled exceptions) makes the rule fail silently — Panther requires the function to return True/False, and exceptions are logged as rule errors. And watch out for performance and cost: every event from every source goes through all active rules; rules with heavy logic or that query external data per event increase analysis cost. Validate rules with real events in the Panther sandbox before enabling them.