Detection rules › Panther

Panther detection rules

1166 detection rules grouped into 90 topic pages by rule-name prefix.

Group	Rules
`admin`	1
`anomalous`	5
`anonymous`	1
`anthropic`	17
`appomni`	1
`asana`	11
`auth0`	26
`aws`	296
`axonius`	5
`azure`	77
`box`	10
`brute`	2
`cb`	6
`cloudflare`	3
`cloudtrail`	3
`crowdstrike`	30
`databricks`	37
`decoy`	5
`defender`	1
`docusign`	5
`domain`	1
`dropbox`	11
`duo`	15
`ec2`	4
`entra`	3
`fuzzy`	1
`gaia`	1
`gcp`	69
`github`	42
`gitlab`	2
`google`	6
`greynoise`	1
`gsuite`	49
`gti`	1
`impossible`	1
`intune`	3
`k8s`	30
`kubernetes`	30
`macos`	2
`malicious`	1
`mfa`	1
`microsoft`	2
`microsoft365`	3
`mongodb`	11
`netskope`	5
`new`	3
`notion`	19
`nx`	1
`okta`	49
`onelogin`	12
`onepass`	2
`onepassword`	4
`openai`	8
`orca`	1
`osquery`	13
`otx`	3
`panther`	4
`potential`	1
`proofpoint`	6
`push`	9
`retrieve`	1
`role`	2
`salesforce`	5
`secret`	1
`sentinelone`	2
`shai`	1
`sign`	1
`signin`	1
`slack`	22
`snowflake`	56
`snyk`	10
`socradar`	1
`source`	1
`standard`	1
`sublime`	4
`suspicious`	1
`system`	1
`tailscale`	3
`teleport`	13
`thinkst`	3
`tines`	9
`tracebit`	1
`upwind`	5
`user`	1
`vpc`	2
`windows`	1
`wiz`	20
`zendesk`	7
`zia`	10
`zoom`	8