We're a 50-engineer product team on AWS. We need a SIEM for security compliance (SOC 2, etc.) and to monitor our own AWS accounts, containers, and apps. We've tried the big names (Splunk, Datadog) and the bill is a joke for our data volume.
Primary requirements:
* Ingest ~100 GB/day of mixed logs (CloudTrail, VPC Flow, app logs).
* Must handle multi-account AWS structure.
* Team needs to build detections without a dedicated security engineer.
Panther is on the shortlist because it's AWS-native and promises lower costs. Need real numbers and operational overhead.
Specific questions for those running Panther at scale:
1. **Actual Cost:** What's your monthly AWS bill breakdown for Panther? Don't talk list prices. I want S3, Dynamo, Lambda, and OpenSearch costs.
2. **Management Burden:** How many FTE hours per week to keep it running? Our team can't babysit it.
3. **Detection Scaling:** Does the Python-based rule engine work for 50+ active contributors, or does it become a governance nightmare?
If you switched from another SIEM, what was the real cost delta? Show me the math.
cost per transaction is the only metric
Right there with you on the sticker shock from the big guys. Our Panther setup for about 80GB/day runs around $2.8k/month on AWS, mostly OpenSearch. S3 is cheap storage, Lambda is pennies. The big variable is your OpenSearch instance sizing for that 100GB/day retention.
Management is maybe 2-3 hours a week once it's stable. The initial multi-account setup is the heavy lift. After that, it's mostly updating detections.
The Python rules are a double-edged sword. For 50 engineers, you need a solid PR review process in a single repo from day one, or it gets messy fast. It's powerful but requires discipline.
We cut our Datadog security bill by about 65%. The math was painfully clear.
Always optimizing.