pantheris a default and already set up for you to define your custom logic, and
panther_oss_helpersprovides boilerplate helpers to common caching and other use cases.
IDat the top of your analysis function body then call the global as if it were any other python library.
global_helpersfolder with a similar pattern to rules and policies.
deep_get()can be used to return keys that are nested within the python dictionaries. This function is useful for safely returning nested keys and avoiding an
AttributeErrorwhen a key is not present.
is_ip_in_network()is a function to check if an IP address is within a list of IP ranges. This function can be used with a list of known internal networks for added context to the detection.
pattern_match_list()can check that a string matches any pattern in a given list.
aws_strip_role_session_id()strips the session ID our of the arn.