Panther detection.py

detection.py → def rule(event): ...

Write and deploy detections in Python on Panther, bringing cloud detection to the SIEM as code with programmatic logic.

Use it when the cloud SIEM is Panther and you want detection with Python logic: the rule(event) function analyzes each event (CloudTrail, GuardDuty, the sources) and returns the verdict — the detection can do what the query cannot (conditional logic, context). It is Panther's detection-as-code: detections in the repo (Python) and deployed with the pipeline (the panther_analysis_tool CLI). In cloud purple teaming with Panther, detections are written, tested (function tests), and deployed — cloud coverage as code.

Do not use it without the platform: Panther (the cloud SIEM) with connected sources is the requirement — without ingestion, the detection has no events. And note: Panther detections are written in Python — poorly handled logic (exceptions) causes the rule to fail silently; function tests (test events) are part of the deployment. Detection of environment-specific items (organizational patterns) is the value; common patterns are covered by managed rules. Validation of detections with purple team exercises (Stratus, 169) confirms the rule sees the attack.