Panther

Panther is a cloud-native security information and event management product that treats detection rules as code. Its site says it is now part of Databricks Lakewatch and describes it as an AI-assisted security operations platform.

What Panther does

• Detection-as-code: hundreds of ready-made detections written in Python or built with no-code rule filters.
• Security data lake: turns large daily log volumes into structured data for investigation.
• Log integrations: native connections to common cloud, SaaS and on-premises applications.
• Investigation: searches for indicators of compromise and historical data that stays readily searchable for an extended retention period.
• AI investigation: automated alert triage that learns from past outcomes.
• Cloud-specific editions: versions aimed at AWS and Snowflake users.

Who it works with

Security engineers and threat detection teams, with a Slack community for sharing detection code.

Key facts

• Owner: part of Databricks Lakewatch
• Origin: open-source, cloud-native design with minimal operations work