V2 Detections Style Guide
V2 detections are in closed beta starting with Panther version 1.108. Please share any bug reports and feature requests with your Panther support team.
Repository structure recommendations
Get up and running quickly by cloning the pypanther-starter-kit repository.
In your code repository where your v2 detections are stored, it's recommended to:
Store custom rule definitions in a
custom_rules
directoryStore logic that makes overrides on Panther-managed rules in an
overrides
directoryIt's recommended for each override file to define an
apply_overrides
function that's called on a rule collection inmain.py
Store custom helpers in a
helpers
directory
main.py
content recommendations
main.py
content recommendationsIt's recommended for your main.py
file to:
Import Panther-managed rules (which you do or don't want to make overrides on) using
get_panther_rules
If you defined
apply_overrides
functions, call it on rule collections
Import custom rules using
get_rules
V2 detection writing best practices
Use filters instead of overriding rule()
rule()
If you would like to alter the logic of a Panther-managed v2 detection, it's recommended to use include/exclude filters instead of overriding the rule's rule()
function. Filters are designed for this purpose—to be applied on top of existing rule logic. They are executed against each incoming event before the rule()
logic, in order to determine if the rule should indeed process the event.
If you are significantly altering the rule logic, you might also consider writing a custom rule instead.
Last updated