Pre-release

This release is a pre-release and may not be stable for production use.

PyPanther

pypanther is a Python framework for writing detection rules with Panther. It provides an intuitive interface for creating, managing, and deploying detections to enhance your security operations. Included is a pypanther CLI tool to interact with your content and upload it to a Panther instance.

Features

Rule Creation: Easily create rules using Python classes and inheritance
Type Safety: Built with type hints for better IDE support and code quality
Testing Framework: Built-in testing utilities for rule validation
CLI Tool: Command-line interface for managing and deploying rules
Helper Functions: Common security detection patterns and utilities
Log Type Support: Native support for major cloud and security log types

Installation

From PyPI

To install pypanther from PyPI, use pip:

pip install pypanther

From Source

To install from source:

git clone https://github.com/panther-labs/pypanther.git
cd pypanther
pip install -e .

Development Setup

For development, we recommend using Poetry:

Install Poetry: Follow the instructions on the Poetry website to install Poetry.

Clone and Install:

git clone git@github.com:panther-labs/pypanther.git
cd pypanther
poetry install

Activate the Environment:
```
poetry shell
```

Prerequisites

Python 3.11 or higher
Panther instance with API access
Poetry (for development)

Quick Start

Here is a simple main.py to get you started with development. Place this in the base directory:

from pypanther import get_panther_rules, register
register(get_panther_rules())

$ poetry run pypanther list rules --log-types Panther.Audit
+-------------------------------------+---------------+------------------+---------+
|                  id                 |   log_types   | default_severity | enabled |
+-------------------------------------+---------------+------------------+---------+
| Panther.Detection.Deleted-prototype | Panther.Audit |       INFO       |   True  |
|   Panther.SAML.Modified-prototype   | Panther.Audit |       HIGH       |   True  |
|   Panther.Sensitive.Role-prototype  | Panther.Audit |       HIGH       |   True  |
|   Panther.User.Modified-prototype   | Panther.Audit |       HIGH       |   True  |
+-------------------------------------+---------------+------------------+---------+

For more detailed examples and implementation patterns, check out the pypanther-starter-kit.

Documentation

Development

Running Tests

poetry run pytest

Code Style

We use ruff for code formatting and linting, and mypy for type checking. To format and lint your code:

# Format code
poetry run ruff format .

# Check and fix imports
poetry run ruff check --select I --fix .

# Run all linting checks
poetry run ruff check --fix .

# Run type checking
poetry run mypy .

You can also use the provided Makefile commands:

# Format code and fix imports
make fmt

# Run all linting and type checking
make lint

Development Guidelines

Follow PEP 8 style guide
Use ruff for code formatting and linting
Use mypy for type checking
Add tests for new features
Update documentation as needed
Keep commits clean and well-documented
Add type hints to all new code

Code of Conduct

This project and everyone participating in it is governed by our Code of Conduct. By participating, you are expected to uphold this code.

Architecture

PyPanther is built with the following design principles:

Modularity: Rules are self-contained and easily composable
Type Safety: Comprehensive type hints for better development experience
Extensibility: Easy to add new rule types and log sources
Testability: Built-in testing framework for rule validation

License

pypanther is released under Apache License 2.0.

Acknowledgments

Thanks to all our contributors
Built with ❤️ by Panther Labs

Metadata

Release files for pypanther 0.1.1a62

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pypanther 0.1.1a62
File	Size	Uploaded
pypanther-0.1.1a62.tar.gz	576.5 kB	Oct 8, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for pypanther 0.1.1a62
File	Interpreter	ABI	Platform	Reset
pypanther-0.1.1a62-py3-none-any.whl 1.2 MB Oct 8, 2026	Python 3	none	any	Details

Total release size: 1.8 MB

Release files / pypanther-0.1.1a62.tar.gz

Download URL	pypanther-0.1.1a62.tar.gz
Size	576.5 kB
Tags	Source
SHA-256 checksum How to use checksums	`e2ebf5465e1d7a33adf1a0a8504b1a346b9051bb0a3e2a341cba5af409189241`
BLAKE2b-256 checksum How to use checksums	`86b21bf9eb5dfc95d1384940113b4bacd0e53714297ef4f151266f258ae98e22`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`poetry/2.5.1 CPython/3.11.17 Linux/6.17.0-1022-azure`

Release files / pypanther-0.1.1a62-py3-none-any.whl

Download URL	pypanther-0.1.1a62-py3-none-any.whl
Size	1.2 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`59c54ac094aa83381a6b0a724c436884ada90ada6d32f1839cf87797d997f010`
BLAKE2b-256 checksum How to use checksums	`72332a57309c444b573d7989d5ae06ff48784cae6202d294e904389c96bc0cd7`
Upload date	Oct 8, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`poetry/2.5.1 CPython/3.11.17 Linux/6.17.0-1022-azure`