pypanther Library Reference

The pypanther library is in closed beta starting with Panther version 1.108. Please share any bug reports and feature requests with your Panther support team.

pypanther convenience function reference

Convenience functionHow it works

get_panther_rules()

get_rules()

register()

override()

Rule property reference

  • Required properties are bolded.

PropertyData typeOverwritten byDefault valueDescription/notes

log_types

List[LogType | String]

id

String

Required only for registered rules

default_severity

Severity | String

severity()

create_alert

Boolean

True

dedup_period_minutes

Non-negative integer

60

default_description

String

description()

“”

display_name

String

“”

enabled

Boolean

True

default_destinations

List[String]

destinations()

[]

default_reference

String

reference()

“”

reports

Dictionary[String,List[String]]

{}

default_runbook

String

runbook()

“”

summary_attributes

List[String]

[]

tags

List[String]

[]

tests

List[RuleTest]

[]

threshold

Positive integer

1

RuleTest property reference

PropertyData typeDefaultDescription

name

String

The name of the test case

expected_result

Boolean

Whether rule() should return true or false

log

Dictionary | String

The log event that should be tested against the detection

mocks

list[RuleMock]

[]

expected_severity

Severity | String

None

The expected severity of the resulting alert

expected_title

String

None

The expected title of the resulting alert

expected_dedup

String

None

The expected deduplication string of the resulting alert

expected_runbook

String

None

The expected runbook of the resulting alert

expected_reference

String

None

The expected reference of the resulting alert

expected_description

String

None

The expected description of the resulting alert

expected_alert_context

Dictionary

None

The expected alert context of the resulting alert

RuleMock property reference

PropertyData typeDefault

object_name

String

return_value

Any

None

side_effect

Any

None

new

Any

None

Rule auxiliary/alerting function reference

  • Required methods are bolded.

FunctionData type it returnsDefault valueDescription/notes

rule()

Boolean

severity()

Severity | String

Value of default_severity

title()

String

Value of display_name

dedup()

String

Value of title() > display_name > id

destinations()

List[String]

Value of default_destinations

runbook()

String

Value of default_runbook

reference()

String

Value of default_reference

description()

String

Value of default_description

alert_context()

Dictionary

Last updated