panther-config 0.0.5

No project description provided

Panther Config SDK

The Panther Config module allows you to configure detections for your Panther instance.

Install

The Panther Config SDK can be installed using PIP.

pip3 install panther_config==0.0.5

query module

CronSchedule

Cron expression based schedule definition for a query

Field	Type	Description
expression	str	Defines how often queries using this schedule run
timeout_minutes	int	Defines the timeout applied to queries with this schedule

IntervalSchedule

Interval based schedule definition for a query

Field	Type	Description
rate_minutes	int	Defines how often queries using this schedule run
timeout_minutes	int	Defines the timeout applied to queries with this schedule

Query

A saved or scheduled query

Field	Type	Description
name	str	Unique name for the query
description	str	Short description for the query
default_database	str	Default database for the query
sql	str	SQL statement
enabled	bool	Short description for the query
tags	typing.Optional[typing.Union[str, typing.List[str]]]	Schedule attached to the query
schedule	typing.Optional[typing.Optional[typing.Union[IntervalSchedule, CronSchedule]]]	Schedule attached to the query

detection module

PythonFilter

Custom python filter

Field	Type	Description
func	typing.Callable[[typing.Any], bool]	Custom python filter

JSONUnitTest

Unit test with json content

Field	Type	Description
name	str	name of the unit test
data	str	json data

DictUnitTest

Unit test with python dict content

Field	Type	Description
data	typing.Dict[str, typing.Any]	json data

Rule

Define a rule

Field	Type	Description
rule_id	str	ID for the rule
severity	str	Severity for the rule
title	typing.Optional[str]	Severity for the rule
log_types	typing.Union[str, typing.List[str]]	Severity for the rule
filters	typing.Union[_BaseFilter, typing.List[_BaseFilter]]	Define event filters for the rule
unit_tests	typing.Optional[typing.Union[_BaseFilter, typing.List[_BaseFilter]]]	Define event filters for the rule