Browse Rules

Detection content has been deleted from Panther

Detection content has been removed from Panther.

Panther SAML configuration has been modified

An Admin has modified Panther's SAML configuration.

Orca Passthrough

Re-raise Orca alerts in Panther

A User's Panther Account was Modified

A Panther user's role has been modified. This could mean password, email, or role has changed for the user.

GitHub Repository Archived

Detects when a repository is archived.

Sensitive File Access - Unattended Panther

Identifies an unusual process accessing Windows Panther Installation files. Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Crowdstrike Detection Summary

Forwards any alerts generated by CrowdStrike to your Panther destinations.

CloudTrail EC2 StopInstances

A CloudTrail instances were stopped. It makes further changes of instances possible

AWS CloudFormation Stack Drift

A stack has drifted from its defined configuration.

AWS Config Status

This policy ensures that the config recorder is operational and capturing changes to your account.

AWS AMI Sharing

This policy ensures that AMIs you have created are not configured to allow public access, which could result in accidental data loss. AMI's that you use but do not own are not evaluated by this policy.

AWS Network ACL Restricts SSH

SSH access should only be granted from protected network CIDR ranges.

AWS Config Recording Status

This policy ensures that the config recorder is operational and capturing changes to your account without error.

AWS CloudFormation Stack IAM Service Role

Associating IAM roles with CloudFormation stacks ensures least privilege when making changes to your account.

Connection to Embargoed Country

Detection to alert when internal asset is communicating with an sanctioned destination. This detection leverages Panther UDM and IPInfo enrichment.

SOCRadar Alert Passthrough

Surfaces all open SOCRadar security incidents as Panther alerts. Severity is mapped dynamically from SOCRadar's alarm_risk_level (CRITICAL/HIGH/MEDIUM/LOW/INFO). SOCRadar performs the underlying threat detection; this rule ensures every open incident is visible in Panther for triage and response.

A User Role with Sensitive Permissions has been Created

A Panther user role has been created that contains admin level permissions.

AWS CloudTrail Least Privilege Access

Users with permissions to disable or reconfigure CloudTrail should be limited.

AWS ELB SSL Policies

Ensures that deprecated TLS versions are not supported in internet-facing load balancers

AWS Config Records All Resource Types

This policy ensurers that you have a comprehensive configuration audit in place for all resource types in AWS.

AWS CloudWatch Log Encryption

AWS automatically performs server-side encryption of logs, but you can encrypt with your own CMK to protect extra sensitive log data.

AWS EC2 Volume Snapshot Encryption

You can encrypt the snapshot of an EC2 volume to protect against accidental data loss

Sensitive AWS CloudWatch Log Encryption

AWS automatically performs server-side encryption of logs, but you can encrypt with your own CMK to protect extra sensitive log data.

AWS RDS Instance Minor Version Upgrades

If you want Amazon RDS to upgrade the DB engine version of a database automatically, you can enable auto minor version upgrades for the database.

Upwind Posture Detection Passthrough

Re-raises Upwind cloud posture and CSPM detections in Panther. Covers cloud misconfigurations, exposed secrets, configuration drift, and CSPM policy violations.