Using the Panther Python detections repo
For general information and best practices for Panther detections, and for information on using web application-based workflows to manage your detections directly in the Panther Console, see the Detections documentation.
Currently, only Python Panther-managed detections are available for you to clone, modify, and upload. YAML Panther-managed detections are planned for a future release.
There are two methods you can use to create a copy of Panther-managed Python detections from the panther-analysis repository:
- If you want to keep your detection content private, we recommend using a private cloned repo. With a private cloned repo, the repository settings will control who has access to the content inside the repo.
- Note that in this configuration, you cannot use a Pull Request to bring changes upstream.