Deprecated Management Flows

Methods for leveraging panther-analysis (Deprecated)

You can create a copy of panther-analysis with one of the following methods:

• Public fork (Legacy)

  • When you use a public fork, your detection content will be publicly visible.

  • A public fork can be used to create pull requests to bring new detection content to the panther-analysis upstream repo.

• Private clone (Legacy)

  • If you want to keep your detection content private, use a private cloned repository. The repository settings will control who has access to the content inside.

  • In this configuration, you cannot use a pull request to bring changes upstream.

After you have your own copy of panther-analysis, you can configure CI/CD workflows.

Staying up to date with panther-analysis releases (Deprecated)

It's recommended to use the Sync Panther Analysis from Upstream GitHub Action, which periodically opens a pull request against your repository's primary branch with the latest changes from panther-analysis.

To learn how to configure this Action, see Keeping your public fork in sync with upstream panther-analysis updates or Keeping your private clone in sync with upstream panther-analysis updates.

In addition to or instead of using the GitHub Action described above, you can use the Slack GitHub integration to be notified in Slack when panther-analysis publishes a new release. Learn more in this Knowledge Base article: How can I stay updated on new Panther-managed detection content?