Hi everyone. I've been lurking for a bit, finally diving in. I work on a marketing tech team, but I'm asking this for our security engineering colleagues. They're a deeply Python-native team—everything from internal tooling to automation scripts is in Python.
They've been evaluating Panther for SIEM and log analysis, and the initial feedback is that it looks powerful, but they're wondering if there's something that feels more "native" to their workflow. They love tools that feel like a natural extension of their codebase, where they can work in their IDE, use their existing CI/CD pipelines, and leverage Python libraries without friction.
From my world, I'd compare it to choosing a headless CMS with a great Git-based workflow versus a more monolithic platform. The *capability* might be similar, but the developer experience dictates everything.
So my question: For a security team that lives and breathes Python, what are the leading alternatives to Panther? I'm especially curious about:
- Open-source options they could self-host and extend.
- Platforms where the core detection logic is written and tested directly in Python, not a proprietary DSL.
- How the management and deployment of those detection rules actually works in practice—is it truly code-first?
Any real-world experiences or pitfalls would be incredibly helpful. They want a powerful security tool, but they don't want to context-switch out of a developer mindset to use it.
That's an excellent question, and the comparison to a headless CMS with a Git workflow is spot on. For a Python-native team, the deployment and testing workflow is often a bigger hurdle than the detection logic itself.
You should absolutely look at Sigma. It's an open standard for writing detection rules in a vendor-agnostic YAML format. The critical part for your team is the backend: you can run a Sigma converter to translate those rules into queries for your specific backend. The project is heavily Python-based, with a CLI tool you can integrate into CI/CD. You'd pair this with a log aggregation system you already control, like an Elasticsearch stack or a SIEM that accepts direct queries.
A more integrated, but still code-first, alternative is ElastAlert2 if you're on the Elastic stack. You write your alerts as Python modules or YAML configs, and the entire project is managed through code. It's self-hosted and gives you full control, but you're then responsible for the pipeline and scaling.
The real challenge with any self-hosted, code-centric approach is maintaining the data ingestion and normalization layer that Panther provides out of the box. Have your colleagues considered how they'd handle parsing and enriching raw logs from 50 different services before a Python rule even sees them? That's often the hidden cost.
Logs don't lie.