Using the Simple Detection Builder

Create and edit detections without code

Overview

You can use the Simple Detection builder in the Panther Console to create and edit rules using drop-down fields. The builder lets you manage detections without writing code, but retains the benefits of detections-as-code, e.g., expressiveness, testability, CI/CD integration, and reusability.

The Simple Detection builder is part of the Simple Detections feature set, which promotes collaboration among team members with all levels of technical skill. Simple Detections constructed in the CLI workflow in YAML, then uploaded to Panther, will be viewable and editable in the Simple Detection builder in the Console.

Rules created in the Simple Detection builder can be used in detection derivation.

See step-by-step instructions on how to create rules using the Simple Detection builder below, in How to create a rule in the Simple Detection builder.

If your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).

If you create or edit detections using the Simple Detection builder in the Console, copy the resulting YAML representation and include it in your local detections files, in order to prevent the changes from being overwritten on next upload.

Video overview

How to access the Simple Detection builder

To access the Simple Detection builder in the Panther console:

1. In the left-hand navigation bar of your Panther Console, click Detections.

2. Click Create New.

3. In the Select Detection Type modal, choose Rule.

4. On the create page, fill in the Name and ID for your detection:

   • Name: Enter a descriptive name for the rule.

   • ID (optional): Click the pen icon and enter a unique ID for your rule.

5. In the For the Following Source section, select the Log Types this detection will apply to.
6. In the Detect section, under How do you want to define your logic? click Simple Detection Builder.

   • The no-code detection builder will appear. The Rule Builder option will be pre-selected.

References to "the Simple Detection builder" in this documentation are to the builder visible when Rule Builder is selected. The Limitations of the Simple Detection builder, for example, do not apply to the Text Editor.

How to create a rule in the Simple Detection builder

You can create rules in the Simple Detection builder in the Panther Console. Learn more about rules on Rules and Scheduled Rules.

If your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).

If you create or edit detections using the Simple Detection builder in the Console, copy the resulting YAML representation and include it in your local detections files, in order to prevent the changes from being overwritten on next upload.

Creating a rule in the Simple Detection builder in the Console

1. Follow the instructions in How to access the Simple Detection builder.
2. To the right of Where, click +. In the menu that appears select either Add Clause or Add Clause Group.
3. For each clause (either on its own or within a group), define the logic:

   1. Click Key, then select an event key the condition will apply to.

   2. Click Condition, then select a condition.

   3. If the selected Condition requires an inputted value(s) (e.g., is or contains), provide a value or list of values.

4. Between each clause and clause group, ensure the correct combinator (either and or or) is selected.

5. (Optional) Once you have finished constructing your detection logic, you can view the result in raw YAML by selecting Text Editor in the toggle in the upper-right corner of the Detect section.

6. In the Create Alert section, set the Create Alert ON/OFF toggle. This indicates whether an alert should be created when there are matches, or only a Signal. If you set this toggle to ON:

   1. Under Required Fields, select a Severity.

      • Learn more about alert severities in the Alert severities table.
   2. Under Optional Fields, set the dynamic alert fields:

      • Title: To the right of Change to, click the plus (+), then enter a string, using curly braces where you want to dynamically substitute an event value.
      • Description: Enter additional context about the rule.

      • Runbook: Enter the procedures and operations relating to this rule.

        • To see examples of runbooks for built-in rules, see Alert Runbooks.
      • Reference: Enter an external link to more information relating to this rule.

      • Destination Overrides: Choose destinations to receive alerts for this detection, regardless of severity. Note that destinations can also be set dynamically, in the rule function. See Routing Order Precedence to learn more about routing precedence.
      • Deduplication Period: Choose a period of time over which to deduplicate events. Learn more in Deduplication of alerts.
      • Events Threshold: Enter the deduplication event threshold. Learn more in Deduplication of alerts.
      • Summary Attributes: Enter the attributes you want to showcase in the alerts that are triggered by this detection.

        • To use a nested field as a summary attribute, use the Snowflake dot notation in the Summary Attribute field to traverse a path in a JSON object: <column>:<level1_element>.<level2_element>.<level3_element> The alert summary will then be generated for the referenced object in the alert. Learn more about traversing semi-structured data in Snowflake here.
        • For more information on Alert Summaries, see Assigning and Managing Alerts.
      • Tags: Enter custom tags to help you understand the rule at a glance (e.g., HIPAA.)

      • Framework Mapping:

        1. Click Add New to enter a report.

        2. Provide values for the following fields:

           • Report Key: Enter a key relevant to your report.

           • Report Values: Enter values for that report.

7. Under Test, in the Unit Test section, click Add New to create a test for the rule.
8. In the upper-right corner, click Deploy.

Limitations of the Simple Detection builder

The Simple Detection builder in the Console cannot render certain YAML expressions. If you locally write and upload Simple Detections using any of the below expressions, they will not be visible in the Simple Detection builder in the Console—they will be shown in raw YAML.

Below are the limitations of the Simple Detection builder:

• Only rules (not scheduled rules nor policies) can be created and/or rendered in the Simple Detection builder.

• Absolute, multi-key, list comprehension, and enrichment match expressions cannot be rendered in the Simple Detection builder.

  • The no-code builder can render key/value and key/values match expressions.
• The OnlyOne and None combinators cannot be rendered in the Simple Detection builder.

  • The Simple Detection builder can render the All and Any combinators.

• In the Alert Context field, event fields of type JSON cannot be used.

• Many Condition values cannot be rendered in the Simple Detection builder. Only the following values may be used:

  • Equals

  • DoesNotEqual

  • IsGreaterThan

  • IsGreaterThanOrEquals

  • IsLessThan

  • IsLessThanOrEquals

  • Contains

  • DoesNotContain

  • StartsWith

  • EndsWith

  • IsIPAddressInCIDR

  • IsIPAddressNotInCIDR

  • CIDRContainsIPAddresses

  • CIDRDoesNotContainIPAddresses

  • IsIn

  • IsNotIn

  • IsIPAddressPublic

  • IsIPAddressPrivate

  • IsNullOrEmpty

  • IsNotNullOrEmpty