Panther Solution Overview

The shift to the cloud has resulted in an explosion of data that security teams need to collect, analyze, and retain to detect threats. But, traditional security monitoring tools were never built with cloud-scale in mind and cannot meet the demands of today’s modern workloads.

Panther was founded by a team of veteran security practitioners who faced the challenges of security operations at scale and set out to build a platform to solve them. The result is Panther, a refreshingly practical platform for threat detection and response.

How It Works

Panther is a cloud-native threat detection platform that transforms terabytes of raw logs per day into a structured security data lake to power real-time detection, swift incident response, and thorough investigations.

• Data Collection: Panther collects security logs from cloud and on-premise data sources via GCS / AWS S3 / SQS / SNS or direct API integrations.
• Log Normalization: Logs are parsed and normalized upon ingestion, ensuring a consistent structure for time and IoC fields to support fast detections
• Real-Time Analysis: Detections are run against log data as it is ingested, providing the fastest possible time to alert.
• Security Data Lake: Normalized data is aggregated in a security data lake where it is readily available for querying without the hassles of managing cold storage.
• Detection as Code: Customize, create and harden detections leveraging Python, unit tests and standard CI/CD workflows, and get started quickly with 400+ built-in detections.
• Automated Response: Add context to alerts dynamically with Python and dispatch alerts to your existing automation workflows.

Benefits

Panther was purpose-built to power threat detection and response at cloud scale, giving security teams a modern security platform to build upon for years to come.

• Detect threats immediately by analyzing logs as soon as they are ingested, giving you the fastest possible time to detection.
• Reduce false positives with Python Detection-as-Code, and CI/CD workflows for creating, testing, and deploying detections.
• Focus on security, not ops with a cloud-native architecture that eliminates the need to manage servers, storage and updates.
• Get answers quickly with the ability to immediately query months of data in minutes and efficiently search for IoCs across all logs.
• Expedite incident response by adding dynamic context to alerts to power more efficient routing, triage, and automation.
• Reduce SIEM costs dramatically while gaining lightning-fast query speeds, with an efficient, highly scalable data lake architecture.