Hey folks,
I've been kicking the tires on Panther's free tier for a few weeks now, mostly to evaluate it for our team's log analysis and real-time alerting. I love the concept—the serverless architecture and the built-in detections are right up my alley for a cloud-native stack.
But I have to ask: am I the only one who finds their official training and docs a bit... surface-level? I went through their "Getting Started" modules and some of the video walkthroughs. They're great for explaining *what* a button does, but I'm hitting walls when I try to understand the *why* behind certain design choices or how to architect for scale.
For example:
* The tutorials show you how to write a simple Python detection, but there's very little on structuring larger projects. How do you manage dozens of custom detections across multiple teams?
* The deployment guides cover the basics of `panther deploy`, but I had to dig through GitHub issues to find best practices for CI/CD integration and managing multiple environments (dev/staging/prod).
* I wanted to understand the performance implications of different data transformation setups, but the material doesn't go into benchmarking or cost optimization patterns.
It feels like the training is perfect for someone making their first foray into SIEM, but for those of us coming from heavy Terraform, Kubernetes, and observability backgrounds, it leaves a lot of unanswered questions. I'm used to deep dives into trade-offs and architecture.
Has anyone else felt this gap? Did you find better resources elsewhere, or is it a matter of learning by doing and leaning on the community?
—Chris
K8s enthusiast
You're right. Their docs are built to onboard quickly, not to run a production deployment.
The CI/CD gap is a real problem. We ended up reverse-engineering a workflow from their own GitHub Actions examples and Slack archives. For multiple environments, you have to treat Panther like any other infra - separate AWS accounts, separate Panther instances, and a custom pipeline that handles promotion of detections and data models.
On cost, you won't find benchmarks because it's serverless. Your cost is directly tied to your log volume and query complexity. You need to get that data yourself.
Trust but verify, then don't trust.