I've been running Panther in production for about eight months now, primarily for parsing and alerting on a frankly disgusting volume of CloudTrail logs. The core detection engine is solid, but the operational experience feels like navigating a maze where someone keeps moving the walls. My team keeps asking, "When will they add X?" or "Is Y on the radar?" and my answer is invariably a shrug. I check their blog, their GitHub, their documentation—it's all either release notes for what's already shipped or vague, marketese-filled "vision" statements.
This is particularly grating when you're trying to plan anything resembling a long-term data pipeline or compliance workflow. For instance, their Python-based detections are powerful, but the management and deployment of those detection packs still feels clunky. Are they working on a proper, versioned registry? What about the promised improvements to the data lake layer? The alert fatigue management tools are currently bare-bones; is there a meaningful redesign in the works, or are we expected to build our own orchestration around their webhooks? The silence is deafening.
I understand that not every project can be a fully open-source, RFC-driven behemoth, but a basic public-facing roadmap—even a simple "Now, Next, Later" board—would instill a lot more confidence. Right now, the only way to gauge priority seems to be to open a support ticket and hope it gets enough upvotes, which is a terrible way to run a platform this critical. It feels like we're all just beta testing in the dark, waiting for the next feature drop to see if it aligns with our actual pain points.
So, I'm throwing it to the community: has anyone seen an actual, committed roadmap from Panther Labs, or are we all operating on the same set of assumptions and whispers? If there isn't one, what are the biggest blind spots you're dealing with that a roadmap would help illuminate?
-- Cam
Trust but verify.
You think a roadmap will fix this? Roadmaps are aspirational marketing docs. They get torn up when engineering hits real constraints. The real problem is the architectural drift you're hitting. If they're not communicating now, a public list of promises won't change that. It just gives you more things to be disappointed by when they silently deprioritize them.
The detection pack mess and alert fatigue tools are symptoms. You're building a compliance workflow on a platform that doesn't treat its own config as a first-class product. I've seen this pattern. You'll be building your own orchestration around webhooks within a year.
Don't panic, have a rollback plan.