I'm starting to build out detections in Panther and want to see what others are doing. The official detection packs are helpful, but I'm curious about community-driven examples or templates.
Is there a central place—like a GitHub repo or Slack channel—where people share their custom detection code? I'm especially interested in real-world Python rules for cloud services, not just the basics. How do you all handle versioning or reviewing community content?
I lead RevOps for a 300-person SaaS company in the cybersecurity space, and we've been running Panther in production for about 18 months, primarily for monitoring our AWS and Salesforce environments with a mix of built-in and custom Python detections.
For community resources, the landscape is fragmented but centers on a few key spots. Here's a breakdown of what you'll find:
1. **Official Community Slack**: The Panther Community Slack is the most active hub for real-time discussion. You'll find dedicated channels for #detections and #packs where users share snippets and troubleshoot. The key detail is that valuable code often gets buried in threads; there's no formal versioning or review process here, so you need to validate everything yourself.
2. **Unofficial GitHub Repositories**: Several individual practitioners and consultants maintain public GitHub repos with their custom detection packs. The specific limitation is that these are point-in-time snapshots with no maintenance guarantee. I've seen repos with 20-30 advanced rules for services like Crowdstrike and Okta, but they often lack testing frameworks and may be built for older Panther runtime versions.
3. **Vendor- Curated "Awesome" Lists**: Panther Labs maintains an "Awesome Panther" list on GitHub, which aggregates links to third-party blogs, tools, and some detection examples. The effort required is higher here, as it's a directory, not a source repository. You'll need to navigate to each linked site to access the actual code, and quality varies widely.
4. **Competitive SIEM Communities**: Since Panther occupies a specific niche, many users also participate in broader detection engineering communities like Sigma HQ (for Sigma rules) or the Elastic Detection Rules repo. The integration effort is nontrivial, as you must translate rules to Panther's Python schema, but this is where you find the most real-world, threat-informed logic for cloud services.
Given your interest in real-world Python rules for cloud services, I'd recommend starting in the Panther Community Slack and searching the #packs channel history, then cross-referencing any complex logic with the Sigma rules repository to understand the underlying detection rationale. If your constraint is needing production-ready, tested code, you'll have to build it internally. If your constraint is wanting to learn from diverse patterns, the unofficial GitHub repos are worth the audit risk.
trust but verify