Hey everyone, been lurking for a bit but finally have something worth posting about. I'm deep in the martech and revenue-ops world, and our team (around 70 devs and analysts) runs almost everything in Python. We're talking data pipelines (Airflow), internal tooling (FastAPI), analytics scripts, you name it. Our security logging has been... piecemeal.
We've been evaluating SIEMs, and the usual enterprise beasts feel like overkill and a nightmare to integrate with our custom Python apps. We need something that speaks our language, doesn't require a dedicated security team to manage, and fits a sub-100 user company budget.
Panther caught my eye specifically because of its Python-native detection-as-code approach. The idea of writing detections as simple Python functions, version controlling them, and having the SIEM itself handle the ingestion and alerting is incredibly appealing from a workflow-automation perspective. It feels like it could slot into our CI/CD pipeline nicely.
Has anyone here actually deployed Panther in a similar environment? I'm particularly curious about:
* Real-world experience with custom log ingestion from Python services. Was writing parsers straightforward?
* The learning curve for a team strong in Python but lighter on traditional security ops.
* How does the cost model hold up with a high volume of custom log sources versus mainly cloud audit logs?
We're leaning towards a PoC, but I'd love to hear from others who've walked this path before jumping in. The promise of a "developer-first" SIEM sounds great, but the devil's always in the details, right? 😅
I run security for a 90-person SaaS company with a similar Python-heavy data stack. We've been using Panther in production for about 18 months, replacing a messy Splunk Franken-rig.
* **Target Audience:** It's built for sub-500 person tech shops with a competent engineering team. You need staff who can write Python and manage infrastructure-as-code. If you're under 100 people, you are the sweet spot. The enterprise beasts like Splunk are built for massive, generic log collection; Panther is built for teams that want to write logic.
* **Real Pricing:** They advertise a "starting at" price, but for our volume (~100 GB/day) and team size, we landed at ~$6k/month on an annual commit. The hidden cost is the engineering time to build your data connectors if your sources aren't pre-built. Budget 2-3 weeks of a mid-level dev's time.
* **Custom Log Ingestion:** Writing parsers in Python is trivial. You subclass a base class, write your logic to return a dict, and you're done. The real friction is normalizing schemas across your custom apps so your detections are clean. We spent more time agreeing on log field names than writing the parsing code.
* **Where It Clearly Wins:** Detection-as-code is the killer feature. You write a detection as a Python function, test it locally, commit it to Git, and CI/CD runs unit tests against it. Our detections live in the same repo as the service code that generates the logs. Alerting logic is just `def rule(event): return True`. It fits exactly into the workflow you described.
* **Where It Breaks:** The UI for ad-hoc historical searching is weak. It's fine for hunting, but if you need to regularly run complex historical queries for compliance reports, you'll be frustrated. It's a detection engine first, a log warehouse second. Their live support is good, but you'll spend more time in their Slack community channel, which is active.
I'd pick Panther for your described use case, specifically if your primary need is real-time detection and automated response from your custom apps. If you need deep historical analytics and fancy dashboards as a core function, you'll need to pair it with something else. Tell us your exact daily log volume and whether you have any compliance reporting requirements (like SOC 2 type 2).
Lisa M.