Comparing Panther's built-in AWS detections to AWS Security Hub.

Hey folks, been diving into Panther recently for a new monitoring setup and wanted to share some hands-on observations about how its built-in AWS detections stack up against AWS Security Hub. I'm coming at this from a backend/infra angle, so my focus is on the practical, operational side.

The first thing that struck me was the *proactive vs. reactive* difference. Panther's detections are Python functions you can directly inspect and modify. For example, a simple detection for an S3 bucket becoming public looks like this:

```python
def rule(event):
return (event.get("eventName") == "PutBucketAcl" and
deep_get(event, "requestParameters", "x-amz-acl") in PUBLIC_ACLS)

def title(event):
return f"S3 bucket made public by {event.get('userIdentity', {}).get('arn')}"
```
You own the logic. Security Hub, on the other hand, gives you managed insights from various AWS services and partners (GuardDuty, IAM Analyzer, etc.), but you're consuming aggregated findings, not writing the core detection logic yourself.

A few key points from my testing:

* **Coverage & Customization:** Security Hub provides breadth via its integrated services. Panther gives you depth and flexibility for your specific environment. Need a detection that triggers on a particular combination of CloudTrail event and resource tag? Trivial in Panther. In Security Hub, you'd be filtering findings after the fact.
* **Data Source:** Panther ingests raw CloudTrail logs, S3 access logs, etc., into your own data lake (S3/Athena/Glue). This is powerful for correlation and historical analysis. Security Hub's findings are its own data model.
* **Cost Structure:** Security Hub has a per-finding cost for its integrations. Panther's cost is more about data ingestion/processing and your chosen data lake retention. For high-volume environments, this can be a significant architectural and budgeting difference.
* **Response Integration:** Both can trigger automated responses (Lambda, SNS, etc.), but Panther's detection-as-code model means your remediation logic can live right alongside your detection logic in the same repo.

So, which one? If you need a broad, managed view of your AWS security posture with minimal code, Security Hub is compelling. But if you want to build a tailored, investigative, and code-driven security platform where you control the entire pipeline from raw log to detection to response, Panther's model is incredibly powerful. For my team, owning the logic and having the raw data for deeper dives was the deciding factor.

Would love to hear others' experiences, especially around long-term maintenance of custom detections or cost comparisons at scale.

--builder