Panther is flexible, intuitive and practical. I have used Panther's Console (UI) and their Panther Analysis repository for detection as code quite frequently. The Panther Console is intuitive and configuring integrations was straightforward. I also used Panther quite frequently for Detection as code. One of the ways I like using it is creating new detections that are derived from Panther's detections and adding any custom logic that's needed for my organization. What I like best: - Support for Detection as Code, i.e. version control, validation, CI/CD etc.). - Integrations with popular alert destinations, log sources, etc. - Ease of Implementation / Ease of Integration Bonus: - I found Panther's customer support to be highly responsive and helpful. They were great at assisting my team and I, whether I had a simple technical question or a complex challenge unique to my organization. - Good Documentation and examples within the documentation

What stands out the most is how fast and flexible Panther is compared to traditional SIEMs. The detection-as-code approach has completely changed how we build and maintain rules—it’s version-controlled, testable, and easy to adapt as our environment changes. Onboarding cloud logs was surprisingly smooth, and the out-of-the-box normalization saved us a ton of setup time. The platform just feels built for modern security teams that need speed without sacrificing accuracy, and the support team has been phenomenal at helping us with all our questions.

There are few key areas where Panther SIEM does an amazing job. First one is the easy way to onboard any log source, it can support various data format and ways to ingest logs, it allows you to easily create parsers and for the out of the box integrations it provides many pre-build detections. Detections can be either written in python or UI low-code builder. There are also capabilities to create scheduled searches and correlation rules. As far as investigation goes there is an AI investigation functionality that is quite good.