Using the Simple Detection Builder

Create and edit detections without code

Overview

You can use the Simple Detection builder in the Panther Console to create and edit rules using drop-down fields. The builder lets you manage detections without writing code, but retains the benefits of detections-as-code, e.g., expressiveness, testability, CI/CD integration, and reusability.

The Simple Detection builder is part of the Simple Detections feature set, which promotes collaboration among team members with all levels of technical skill. Simple Detections constructed in the CLI workflow in YAML, then uploaded to Panther, will be viewable and editable in the Simple Detection builder in the Console.

Rules created in the Simple Detection builder can be used in detection derivation.

See step-by-step instructions on how to create rules using the Simple Detection builder below, in How to create a rule in the Simple Detection builder.

If your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).

If you create or edit detections using the Simple Detection builder in the Console, copy the resulting YAML representation and include it in your local detections files, in order to prevent the changes from being overwritten on next upload.

Video overview

Limitations of the Simple Detection builder

The Simple Detection builder in the Console cannot render certain YAML expressions. If you locally write and upload Simple Detections using any of the below expressions, they will not be visible in the Simple Detection builder in the Console—they will be shown in raw YAML.

Below are the limitations of the Simple Detection builder:

• Only rules (not scheduled rules nor policies) can be created and/or rendered in the Simple Detection builder.

• Absolute, multi-key, list comprehension, and enrichment match expressions cannot be rendered in the Simple Detection builder.

  • The no-code builder can render key/value and key/values match expressions.

• The OnlyOne and None combinators cannot be rendered in the Simple Detection builder.

  • The Simple Detection builder can render the All and Any combinators.

• Many Condition values cannot be rendered in the Simple Detection builder. Only the following values may be used:

  • Equals

  • DoesNotEqual

  • IsGreaterThan

  • IsGreaterThanOrEquals

  • IsLessThan

  • IsLessThanOrEquals

  • Contains

  • DoesNotContain

  • StartsWith

  • EndsWith

  • IsIPAddressInCIDR

  • IsIPAddressNotInCIDR

  • CIDRContainsIPAddresses

  • CIDRDoesNotContainIPAddresses

  • IsIn

  • IsNotIn

  • IsIPAddressPublic

  • IsIPAddressPrivate

  • IsNullOrEmpty

  • IsNotNullOrEmpty

How to create a rule in the Simple Detection builder

You can create rules in the Simple Detection builder in the Panther Console. Learn more about rules on Rules and Scheduled Rules.

If your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).

If you create or edit detections using the Simple Detection builder in the Console, copy the resulting YAML representation and include it in your local detections files, in order to prevent the changes from being overwritten on next upload.

Creating a rule in the Simple Detection builder in the Console

1. In the left-hand navigation bar of your Panther Console, click Build > Detections.

2. Click Create New.

3. In the Select Detection Type modal, choose Rule.

4. On the create page, fill in the Name and ID for your detection:

   • Name: Enter a descriptive name for the rule.

   • ID (optional): Click the pen icon and enter a unique ID for your rule.

5. In the For the Following Source section, select the Log Types this detection will apply to.
6. In the Detect section, under How do you want to define your logic? click Simple Detection Builder.

   • The no-code detection builder will appear.

7. To the right of Where, click +. In the menu that appears select either Add Clause or Add Clause Group.
8. For each clause (either on its own or within a group), define the logic:

   1. Click Key, then select an event key the condition will apply to.

      • To indicate a nested field, use JSON path notation.

      • Some options may include [*], indicating the key is an array of objects. Learn more about indexing an array of objects here.

   2. Click Condition, then select a condition.

   3. If the selected Condition requires an inputted value(s) (e.g., is or contains), provide a value or list of values.

      • If the values(s) field takes in an array, see these instructions for inputting array values.

9. Between each clause and clause group, ensure the correct combinator (either and or or) is selected.

10. (Optional) Once you have finished constructing your detection logic, you can view the result in raw YAML by selecting Text Editor in the toggle in the upper-right corner of the Detect section.

11. In the Set Alert Fields section, under Required Fields, select a Severity.

    • You can optionally configure the severity of the generated alert to be dynamically set based on the content of the event that triggered the alert. To do so:

      1. Click Add Severity.

      2. To the right of Change to, select a Severity.

      3. To the right of if, click the plus icon (+), then define a condition under which this severity should be used:

         1. Click Key, then select an event key the condition will apply to.

         2. Click Condition, then select a condition.

         3. If the selected Condition requires an inputted value(s) (e.g., is or contains), provide a value or list of values.

         4. Repeat for as many conditions as desired.

            • Multiple conditions are joined by AND logic. OR logic is not supported.

      4. Repeat for as many severities as desired.
    • Learn more about alert severities in the Alert severities table.

12. Within Optional Fields, set additional dynamic alert fields if desired:

    • Title:

      1. To the right of Change to, click the plus icon (+).

      2. Enter a string, using curly braces where you want to dynamically substitute an event value.
    • Group by:

      1. To the right of Change to group log events by, click the plus icon (+).

      2. Select one or more event fields. Multiple fields are joined by AND logic.

         • This field sets the deduplication string for your detection. The event values from the keys provided here are joined with a colon to form the deduplication string.

         • Example: The outputted deduplication string for the Group by configuration in the screenshot above would be:

         <value of userIdentity.userName>:<value of sourceIPAddress>

         • Learn more about deduplication, including the order of precedence for how the deduplication string is set, on Rules and Scheduled Rules.

    • Alert Context:

      1. Under Alert Context, click the plus icon (+).

      2. Click Key, then enter a string.

         • In the alert context dictionary passed to generated alerts, this will be a key.

      3. Click Value, then select an event field.

         • In the alert context dictionary passed to generated alerts, the value of this event field will be a value.

      4. Repeat to create as many pairs as you'd like.
13. Further down within Optional Fields, set the static alert fields:

    • Description: Enter additional context about the rule.

    • Runbook: Enter the procedures and operations relating to this rule.

      • To see examples of runbooks for built-in rules, see Alert Runbooks.

    • Reference: Enter an external link to more information relating to this rule.

    • Destination Overrides: Choose destinations to receive alerts for this detection, regardless of severity. Note that destinations can also be set dynamically, in the rule function. See Routing Order Precedence to learn more about routing precedence.

    • Deduplication Period: Choose a period of time over which to deduplicate events. Learn more in Deduplication of alerts.

    • Events Threshold: Enter the deduplication event threshold. Learn more in Deduplication of alerts.

    • Summary Attributes: Enter the attributes you want to showcase in the alerts that are triggered by this detection.

      • To use a nested field as a summary attribute, use the Snowflake dot notation in the Summary Attribute field to traverse a path in a JSON object:

        <column>:<level1_element>.<level2_element>.<level3_element>

        The alert summary will then be generated for the referenced object in the alert. Learn more about traversing semi-structured data in Snowflake here.

      • For more information on Alert Summaries, see Assigning and Managing Alerts.

    • Tags: Enter custom tags to help you understand the rule at a glance (e.g., HIPAA.)

    • Framework Mapping:

      1. Click Add New to enter a report.

      2. Provide values for the following fields:

         • Report Key: Enter a key relevant to your report.

         • Report Values: Enter values for that report.

14. Within Test, in the Unit Test section, click Add New to create a test for the rule.

15. In the upper-right corner, click Deploy.