Panther’s SIEM iteration into the AI security space has been a real shift in our security team’s capabilities. With AI Auto Triage, the triage process is quick, and the Panther AI integration enables automated threat hunting. Having threat intel pushed into the MCPs has also been helpful.

The price-to-capability balance feels fair, and it’s the only SIEM I’ve seen so far that has pushed this heavily into SIEM + AI integration. The standard plug-and-play integrations are limited to a typical security tech stack; however, it isn’t difficult to ship logs to S3 and normalize them directly in Panther.

Using a Snowflake datalake, queries are efficient and it’s one of the more seamless ways I’ve used to query log sources at scale. We also have monthly visits with the Panther team to help integrate and upgrade our instances, uncover new release items, and help us engineer the platform for success.

Lastly, the UI/UX is easy to navigate. Most SIEMs are difficult to work with, with buttons doing various things across different areas. This is a SIEM through and through: if you know what you want to find or what detection you want to build, you can do it easily since the backend query structure is SQL and the detections are all detection as code. Review collected by and hosted on G2.com.

The hardest part of working with Panther is making sure you manage your detections as code in a solid, maintainable way. It’s easy for your implementation to drift and become out of date compared with the upstream managed Panther repo. Before you start implementing rules and creating your own detections, it’s really important to think through the upstream conflicts that can come up when you customize things. If you account for that upfront while designing your detection-as-code infrastructure, you shouldn’t run into major problems. Review collected by and hosted on G2.com.

What I like best about Panther is how quickly it helps us move from alert to action. It’s powerful and highly automated, with strong native integrations that made setup and onboarding easy across teams. Features like enrichment and AI-assisted analysis make SOC investigations much faster and simpler, and the support team is consistently responsive whenever we need help. Review collected by and hosted on G2.com.

At the moment, I don’t have any major dislikes. Our experience with Panther has been smooth so far, from onboarding to daily SOC operations. Review collected by and hosted on G2.com.

Panther is a compact, powerful SIEM with AI Analytics that are currently evolving by the day. Each category is easy to browse and use, there are several integrations that can be requested, the price is very competitive with other tools on the market, and the custom rule builder is very well designed. Review collected by and hosted on G2.com.

The tool is still in its infancy, however as it continues to grow and reaches action parity with larger, more advanced SIEMs, it will be world class Review collected by and hosted on G2.com.

The support team is responsive and provides detailed guidance when we need help.

The platform is easy to implement and operate, even with a small team. Through its intuitive interface and AI capabilities, a small security team can work as effectively as larger ones.

Cost predictability is a significant advantage. Panther's cost structure allows us to forecast our security budget accurately, which is important for planning.

The MCP (Model Context Protocol) integration lets us build custom detection rules that combine Panther's data with our local data sources for tailored threat detection. MCP and PantherAI also help non-native English speakers quickly understand complex security information, reducing language barriers across our team. Review collected by and hosted on G2.com.

I don't have any significant concerns or areas where I feel Panther needs improvement. Review collected by and hosted on G2.com.

Detection as code is handy for version control and creating an alert lifecycle (dev/staging/prod) Panther AI Triage is a game changer! Add in Panther MCP and GitHub Co-Pilot and we are on the cusp of fully automating a lot of our work! Review collected by and hosted on G2.com.

Alert pipeline includes unnecessary checks (via yaml and the test cases) that are really perfunctory and don't actually test the logic of the rule in question. Also fits unit testing approach which aligns more with software development than security. Review collected by and hosted on G2.com.

Detection as code is awesome. Also, the mcp allows me to work through investigations super quickly. Review collected by and hosted on G2.com.

Not all services are supported, in line with what you'd expect from a new product. Review collected by and hosted on G2.com.

Built for what matters in SecOps, detection and response at scale. Panther does not waste time on useless features as everything has purpose and meaning. Their search function has 3 modes, with PantherFlow being very much like KQL and a delight to use. The DAC concepts are top notch and .. their AI SOC functions actually work, Panther AI may be one of the best on the market right now. Review collected by and hosted on G2.com.

I’d prefer if it also supported self-hosting in Azure, in addition to AWS. That said, AWS works perfectly fine for me—it’s really just a matter of personal preference. Review collected by and hosted on G2.com.

The most useful feature is the Panther AI which helps to quickly skim through your logs, create search queries and also queries for creating the dashboard Review collected by and hosted on G2.com.

At times, I run into UI issues with Panther AI when fetching results, and I think this part of the experience could be improved. Review collected by and hosted on G2.com.

I appreciate Panther for precisely meeting our needs and offering great value. Setting up Panther was smooth and easy, and the onboarding mentoring was super helpful. The Terraform interface is very nice for its supported features. Panther closed a critical gap by centralizing security event logs from various systems, simplifying incident investigation and correlation. PantherAI has been a significant help, taking the guesswork out of security incidents and enabling quicker issue identification. The UI is easy to use and navigate, and the alert investigation tools are intuitive. Review collected by and hosted on G2.com.

I would like to see greater Terraform support and the ability to manage rules as code outside of the Panther Analysis repository mechanism. Review collected by and hosted on G2.com.

Context for alerts, easy easy log source integration and clear development pipeline Review collected by and hosted on G2.com.

Raw log view without a basic summary of each alert unless AI triage is run Review collected by and hosted on G2.com.