PyPanther Detections Style Guide
PyPanther Detections are in closed beta starting with Panther version 1.108. Please share any bug reports and feature requests with your Panther support team.
Repository structure recommendations
Get up and running quickly by cloning the pypanther-starter-kit repository.
In your code repository where your PyPanther Detections are stored, it's recommended to:
Maintain a top-level module,
content
, in which all of your custom Python code is stored (except for themain.py
file).The top-level directory we are calling
content/
can be named anything exceptsrc/
, which is a reserved repository name in Panther.Within this folder, it's recommended to:
Store custom rule definitions in a
rules
directory.Store logic that makes overrides on Panther-managed rules in an
overrides
directory.It's recommended for each override file to define an
apply_overrides
function that's called on a rule collection inmain.py
.
Store custom helpers in a
helpers
directory.
main.py
content recommendations
main.py
content recommendationsIt's recommended for your main.py
file to:
Import Panther-managed rules (which you do or don't want to make overrides on) using
get_panther_rules
If you defined
apply_overrides
functions, call it on rule collections
Import custom rules using
get_rules
Best practices for PyPanther Detection writing
Use filters instead of overriding rule()
rule()
If you would like to alter the logic of a Panther-managed PyPanther Detection, it's recommended to use include/exclude filters instead of overriding the rule's rule()
function. Filters are designed for this purpose—to be applied on top of existing rule logic. They are executed against each incoming event before the rule()
logic, in order to determine if the rule should indeed process the event.
If you are significantly altering the rule logic, you might also consider writing a custom rule instead.
Last updated