◆ Detection rules

Panther Analysis

Apache-2.0

Panther's built-in detection rules and policies, written in Python with YAML metadata and unit tests per rule.

source ↗ ★ 464 last push 2026-09-10

Summary

Panther is a modern SIEM built for security operations at scale. With Panther, teams can define detections as code and programmatically upload them to your Panther deployment. This repository contains all detections developed by the Panther Team and the Community.

from the project README

Formats: pythonyaml
License: Apache-2.0
Added: 2026-09-10

Get it

From the project’s own instructions where it documents any; otherwise a plain clone.

shell
```
$ git clone https://github.com/panther-labs/panther-analysis.git
```
The README clones over SSH; this is the same repository over HTTPS.

shell

$ cd panther-analysis && make install && pipenv run panther_analysis_tool test --path rules/aws_cloudtrail_rules/

Runs the bundled unit tests for the CloudTrail rules. Needs pipenv.

2,556 files 12.5 MB repository

.yml 1,363
.py 1,127
.md 33
.json 13
(no ext) 9
.txt 3
.png 2
.sh 2

Panther Analysis

Summary

Get it

Contents