We've been using Panther as our primary SIEM for about six months now, moving from a more legacy on-prem solution. I was tasked with the evaluation and migration, so I wanted to share where it's landed for our team. We're a mid-market SOC, handling around 10K employees, with a mix of cloud (AWS, Azure) and on-prem infrastructure.
The initial appeal was clear: cloud-native, promise of lower operational overhead, and the SQL-based alerting. After half a year, the picture is mixed.
**The Good:**
* **Detection-as-Code is real:** Writing detection rules in Python is powerful. Version control, peer reviews, and the ability to package reusable logic has improved our workflow.
* **Cloud log onboarding:** For AWS CloudTrail, S3, etc., it's straightforward. The auto-schemas and built-in parsers work as advertised.
* **Cost predictability:** Compared to ingest-volume pricing of some competitors, their pricing model (based on data scanned) is easier to forecast for us.
**The Not-So-Good:**
* **The learning curve:** The shift to writing everything in Python/Panther's framework was steeper than expected for some analysts. It requires more developer-minded staff.
* **Dashboarding feels like an afterthought:** The built-in dashboards are basic. For stakeholder reports, we often find ourselves pulling data externally. How does this compare to, say, a more mature dashboarding suite in a competitor?
* **Managed detections gap:** Their out-of-the-box content is okay, but we found ourselves writing a lot of custom rules for our internal apps. The coverage for niche SaaS tools wasn't there. This meant more upfront work than we'd hoped.
**Open questions for the community:**
* How does Panther's incident workflow and case management truly scale compared to dedicated SOAR platforms? We're still mostly manual.
* For those who also handle a lot of on-prem logs (firewalls, Windows events), how have you found the parsing and performance? We've had some hiccups.
* Has anyone done a detailed TCO comparison against, say, a Sentinel or a managed Elastic stack over a 2-3 year horizon? Our initial math favored Panther, but the internal dev cost for customizations is a factor.
Overall, it's a powerful tool for teams willing to embrace the code-first mentality, but it demands more internal engineering resources than we initially budgeted. The core detection engine is solid, but the surrounding SOC ecosystem features feel less mature.
Thanks for sharing this. The developer-mindset shift you mentioned is a recurring theme we see in teams adopting these modern platforms. It can really widen the gap between your most and least technical analysts.
You cut off at "Dashboarding fee," but if that's about the add-on cost for custom dashboards, I'd be curious if your team has found the default reporting sufficient, or if that fee felt like a paywall for a core feature. That kind of detail helps others weigh the total cost of ownership.
For the learning curve, did you implement any internal training or pair up analysts with different skill sets to help spread the knowledge? Sometimes that internal scaffolding is what makes or breaks the transition.
Stay curious, stay critical.
You're right about the developer-mindset shift, but we found it cut both ways. Our more technical analysts immediately ran with the Python-based rules and automation. The less technical ones got left behind, relying on pre-built content and creating a bottleneck. Pairing them up helped some, but the skill gap still dictates operational tempo more than I'd like.
Regarding the dashboarding fee, it absolutely felt like a paywall for a feature we considered core for data exploration and custom reporting for different stakeholders. The default dashboards are essentially glorified health checks. We ended up routing Panther data to a separate BI tool for actual dashboarding, which added cost and latency. For a premium cloud SIEM, that's a disappointing corner to cut.
Show me the benchmarks
Thanks for coming back and finishing the initial post, I was waiting for that. Your mixed review lines up with what I've heard from a few other teams on the migration path.
You've nailed the core trade-off: a platform built for engineers can really accelerate those who can code, but it does risk leaving others behind. We've tackled that by creating some template rules and a shared library of helper functions that abstract away the trickiest parts of the framework. It's a band-aid, but it helps.
The dashboarding fee issue is more frustrating. It's a bad look for a modern tool to nickle-and-dime on visibility. Routing to an external BI tool as you described is a solid workaround, but you shouldn't have to pay for two tools to get one complete picture.
ship early, test often