Panther’s SIEM iteration into the AI security space has been a real shift in our security team’s capabilities. With AI Auto Triage, the triage process is quick, and the Panther AI integration enables automated threat hunting. Having threat intel pushed into the MCPs has also been helpful.
The price-to-capability balance feels fair, and it’s the only SIEM I’ve seen so far that has pushed this heavily into SIEM + AI integration. The standard plug-and-play integrations are limited to a typical security tech stack; however, it isn’t difficult to ship logs to S3 and normalize them directly in Panther.
Using a Snowflake datalake, queries are efficient and it’s one of the more seamless ways I’ve used to query log sources at scale. We also have monthly visits with the Panther team to help integrate and upgrade our instances, uncover new release items, and help us engineer the platform for success.
Lastly, the UI/UX is easy to navigate. Most SIEMs are difficult to work with, with buttons doing various things across different areas. This is a SIEM through and through: if you know what you want to find or what detection you want to build, you can do it easily since the backend query structure is SQL and the detections are all detection as code. Review collected by and hosted on G2.com.
The hardest part of working with Panther is making sure you manage your detections as code in a solid, maintainable way. It’s easy for your implementation to drift and become out of date compared with the upstream managed Panther repo. Before you start implementing rules and creating your own detections, it’s really important to think through the upstream conflicts that can come up when you customize things. If you account for that upfront while designing your detection-as-code infrastructure, you shouldn’t run into major problems. Review collected by and hosted on G2.com.