# Panther Analysis Tool

## Overview

Panther Analysis Tool (PAT) is a CLI tool you can use to test, package and upload locally managed detection content (among other actions—view them all on [PAT Commands](https://docs.panther.com/panther-developer-workflows/detections-repo/pat/pat-commands)). It's designed for developer-centric Panther workflows, such as managing your detection content programmatically, and [integrating with CI/CD pipelines](https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd). PAT is open-source—see its [GitHub repository here](https://github.com/panther-labs/panther_analysis_tool).

If you'd instead prefer to manage detection content in the Panther Console using web application-based workflows, see [Detections](https://docs.panther.com/detections).

## Getting started with PAT <a href="#uploading-to-panther" id="uploading-to-panther"></a>

Before you can use PAT to test, package, and upload your detection content, you'll need to install it, set configuration values, and generate an API token for authentication. Learn how to complete each of these steps on [Install, Configure, and Authenticate with PAT](https://docs.panther.com/panther-developer-workflows/detections-repo/pat/install-configure-and-authenticate-with-pat).

## Managing detections with PAT <a href="#uploading-to-panther" id="uploading-to-panther"></a>

After you've completed PAT setup, you can start using it to manage your detection content with commands like [test](https://docs.panther.com/panther-developer-workflows/detections-repo/pat-commands#test-running-tests-with-pat), [validate](https://docs.panther.com/panther-developer-workflows/detections-repo/pat-commands#validate-ensuring-detection-content-is-ready-to-be-uploaded), [zip](https://docs.panther.com/panther-developer-workflows/detections-repo/pat-commands#zip-creating-a-package-to-upload-to-the-panther-console), and [upload](https://docs.panther.com/panther-developer-workflows/detections-repo/pat-commands#upload-uploading-packages-to-panther-directly). Explore all you can do with PAT on [Panther Analysis Tool Commands](https://docs.panther.com/panther-developer-workflows/detections-repo/pat/pat-commands).

### Writing custom detection content locally <a href="#uploading-to-panther" id="uploading-to-panther"></a>

Before you use PAT to upload your custom detection content to your Panther instance, you can need to create it locally. Writing detection content locally means creating files that define it on your own machine.

Learn how to write different types of detection content locally on the following pages:

* Detections
  * [Writing Python rules and scheduled rules locally](https://docs.panther.com/detections/rules#how-to-write-rules-and-scheduled-rules)
    * [Writing Simple Detections (rules) locally](https://docs.panther.com/detections/rules/writing-simple-detections#how-to-create-a-simple-detection-rule-in-yaml)
    * [Creating Derived Detections (rules)](https://docs.panther.com/detections/rules/derived#how-to-create-a-derived-detection)
  * [Writing correlation rules locally](https://docs.panther.com/detections/correlation-rules#creating-a-correlation-rule-in-yaml-in-the-cli-workflow)
  * [Writing policies locally](https://docs.panther.com/detections/policies#how-to-write-a-policy)
* Other detection content
  * [Writing Saved Searches locally](https://docs.panther.com/search/scheduled-searches#how-to-create-a-saved-search)
  * [Writing Scheduled Searches locally](https://docs.panther.com/search/scheduled-searches#how-to-create-a-scheduled-search)
  * [Using Lookup Tables locally](https://docs.panther.com/enrichment/custom#how-to-configure-a-lookup-table)
  * [Creating Data Models locally](https://docs.panther.com/detections/rules/python/data-models#how-to-create-a-data-model-in-the-cli-workflow)
  * [Creating global helpers locally](https://docs.panther.com/detections/rules/python/globals#adding-custom-globals)

### Customizing Panther-managed detections

You can also use PAT to manage [Panther-managed](https://docs.panther.com/detections/panther-managed) detections you've customized. To manage custom detections, you can privately clone or publicly fork the public [panther-analysis GitHub repository](https://github.com/panther-labs/panther-analysis). Then, upon [tagged releases](https://github.com/panther-labs/panther-analysis/releases), you can pull upstream changes.

Learn how to fork or clone the panther-analysis repository on [Using the Panther detections repo](https://docs.panther.com/panther-developer-workflows/detections-repo).

#### Getting updates of Panther-managed detections

When you want to update your detections with the latest versions from Panther Analysis, run `pat update`. This will automatically merge the latest version of a detection with your local copy. Any detections with merge conflicts will be printed out and can be resolved with `pat merge <id>`.

* You can run with the `--auto-accept` option to pick your changes or Panther's changes automatically for each merge conflict.
* You can run with the `--write-merge-conflicts` to solve all conflicts all at once instead of one at a time.
* To get updates, the detection must have a `BaseVersion` field set. If it does not have one yet, use `pat migrate <id>` to add it.

If you would like to get new content Panther Analysis has released, you can use `pat install`. You can view what the new content looks like before cloning it with `pat explore`.

## Troubleshooting the Panther Analysis Tool

Visit the Panther Knowledge Base to [view articles about the Panther Analysis Tool](https://help.panther.com/Panther_Developer_Workflows/Panther_Analysis_Tool_\(PAT\)) that answer frequently asked questions and help you resolve common errors and issues.