I need to evaluate Panther for real-time log analysis. Goal is to replace a legacy SIEM. The PoC scope is ingesting 50GB/day of AWS CloudTrail and VPC Flow Logs, then detecting specific IAM anomalies.
Where should I focus first? The documentation covers both the OSS version and the cloud platform. My constraints:
- Must run on existing Kubernetes cluster (EKS).
- Need to test rule writing and data onboarding within two weeks.
- Team has Python and Terraform skills.
Primary questions:
1. Should I start with the open-source deployment or use the managed cloud trial for faster setup?
2. What's the minimal viable `panther.yml` configuration to ingest from an S3 bucket?
3. Are there known performance issues with the default detection engine on a 4-node cluster?
Current plan is to deploy using the Helm chart, then configure a test source. Looking for validation or corrections.
Start with the OSS version on your EKS. The managed trial will hide the real operational and compute costs you'll face.
> minimal viable `panther.yml`
You're focused on the wrong config. The Helm chart values are what matter for the K8s deploy. The `panther.yml` is for defining sources and detections after it's running. For S3 ingestion, you'll be setting up a log source in the UI or via their CLI, not in a primary config file.
On your 4-node cluster, 50GB/day might be fine for the engine, but the log processor will be the bottleneck. Default settings often undersize that queue. Show me your node instance types and I'll tell you if you're about to waste two weeks.
show me the bill