{"id":30178292,"url":"https://github.com/panther-labs/pypanther","last_synced_at":"2025-08-12T05:18:41.025Z","repository":{"id":286585768,"uuid":"813817292","full_name":"panther-labs/pypanther","owner":"panther-labs","description":"A Pythonic Detection Rules Framework","archived":false,"fork":false,"pushed_at":"2025-07-21T11:03:37.000Z","size":3351,"stargazers_count":11,"open_issues_count":6,"forks_count":2,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-07-21T11:43:56.205Z","etag":null,"topics":["detection-as-code","detection-engineering","incident-response","infosec","monitoring","panther","security"],"latest_commit_sha":null,"homepage":"https://www.panther.com","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/panther-labs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-06-11T19:55:56.000Z","updated_at":"2025-07-21T11:03:11.000Z","dependencies_parsed_at":"2025-04-25T10:36:34.059Z","dependency_job_id":"b69992bb-e2a9-43fb-96f8-73f04edf4434","html_url":"https://github.com/panther-labs/pypanther","commit_stats":null,"previous_names":["panther-labs/pypanther"],"tags_count":58,"template":false,"template_full_name":null,"purl":"pkg:github/panther-labs/pypanther","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panther-labs%2Fpypanther","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panther-labs%2Fpypanther/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panther-labs%2Fpypanther/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panther-labs%2Fpypanther/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/panther-labs","download_url":"https://codeload.github.com/panther-labs/pypanther/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panther-labs%2Fpypanther/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270005591,"owners_count":24510939,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-12T02:00:09.011Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["detection-as-code","detection-engineering","incident-response","infosec","monitoring","panther","security"],"created_at":"2025-08-12T05:18:19.837Z","updated_at":"2025-08-12T05:18:41.004Z","avatar_url":"https://github.com/panther-labs.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PyPanther\n\n[![PyPI version](https://badge.fury.io/py/pypanther.svg)](https://badge.fury.io/py/pypanther)\n[![Python Versions](https://img.shields.io/pypi/pyversions/pypanther.svg)](https://pypi.org/project/pypanther/)\n[![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE.txt)\n[![Code style: ruff](https://img.shields.io/badge/code%20style-ruff-000000.svg)](https://github.com/astral-sh/ruff)\n\n**pypanther** is a Python framework for writing detection rules with Panther. It provides an intuitive interface for creating, managing, and deploying detections to enhance your security operations. Included is a `pypanther` CLI tool to interact with your content and upload it to a Panther instance.\n\n## Features\n\n- **Rule Creation**: Easily create rules using Python classes and inheritance\n- **Type Safety**: Built with type hints for better IDE support and code quality\n- **Testing Framework**: Built-in testing utilities for rule validation\n- **CLI Tool**: Command-line interface for managing and deploying rules\n- **Helper Functions**: Common security detection patterns and utilities\n- **Log Type Support**: Native support for major cloud and security log types\n\n## Installation\n\n### From PyPI\n\nTo install **pypanther** from PyPI, use pip:\n\n```bash\npip install pypanther\n```\n\n### From Source\n\nTo install from source:\n\n```bash\ngit clone https://github.com/panther-labs/pypanther.git\ncd pypanther\npip install -e .\n```\n\n### Development Setup\n\nFor development, we recommend using Poetry:\n\n1. **Install Poetry**: Follow the instructions on the [Poetry website](https://python-poetry.org/docs/#installation) to install Poetry.\n\n2. **Clone and Install**:\n   ```bash\n   git clone git@github.com:panther-labs/pypanther.git\n   cd pypanther\n   poetry install\n   ```\n\n3. **Activate the Environment**:\n   ```bash\n   poetry shell\n   ```\n\n## Prerequisites\n\n- Python 3.11 or higher\n- [Panther](https://panther.com) instance with API access\n- Poetry (for development)\n\n## Quick Start\n\nHere is a simple `main.py` to get you started with development. Place this in the base directory:\n\n```python\nfrom pypanther import get_panther_rules, register\nregister(get_panther_rules())\n```\n\n```bash\n$ poetry run pypanther list rules --log-types Panther.Audit\n+-------------------------------------+---------------+------------------+---------+\n|                  id                 |   log_types   | default_severity | enabled |\n+-------------------------------------+---------------+------------------+---------+\n| Panther.Detection.Deleted-prototype | Panther.Audit |       INFO       |   True  |\n|   Panther.SAML.Modified-prototype   | Panther.Audit |       HIGH       |   True  |\n|   Panther.Sensitive.Role-prototype  | Panther.Audit |       HIGH       |   True  |\n|   Panther.User.Modified-prototype   | Panther.Audit |       HIGH       |   True  |\n+-------------------------------------+---------------+------------------+---------+\n```\n\nFor more detailed examples and implementation patterns, check out the [pypanther-starter-kit](https://github.com/panther-labs/pypanther-starter-kit).\n\n## Documentation\n\n- [User Guide](https://docs.panther.com/detections/pypanther)\n- [Library Reference](https://docs.panther.com/detections/pypanther/library-reference)\n- [CLI Guide](https://docs.panther.com/detections/pypanther/cli)\n- [Rule Development Guide](https://docs.panther.com/detections/pypanther/creating)\n\n## Development\n\n### Running Tests\n\n```bash\npoetry run pytest\n```\n\n### Code Style\n\nWe use `ruff` for code formatting and linting, and `mypy` for type checking. To format and lint your code:\n\n```bash\n# Format code\npoetry run ruff format .\n\n# Check and fix imports\npoetry run ruff check --select I --fix .\n\n# Run all linting checks\npoetry run ruff check --fix .\n\n# Run type checking\npoetry run mypy .\n```\n\nYou can also use the provided Makefile commands:\n\n```bash\n# Format code and fix imports\nmake fmt\n\n# Run all linting and type checking\nmake lint\n```\n\n### Development Guidelines\n\n- Follow PEP 8 style guide\n- Use `ruff` for code formatting and linting\n- Use `mypy` for type checking\n- Add tests for new features\n- Update documentation as needed\n- Keep commits clean and well-documented\n- Add type hints to all new code\n\n### Code of Conduct\n\nThis project and everyone participating in it is governed by our [Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.\n\n## Architecture\n\nPyPanther is built with the following design principles:\n\n- **Modularity**: Rules are self-contained and easily composable\n- **Type Safety**: Comprehensive type hints for better development experience\n- **Extensibility**: Easy to add new rule types and log sources\n- **Testability**: Built-in testing framework for rule validation\n\n## License\n\n**pypanther** is released under [Apache License 2.0](LICENSE.txt).\n\n## Acknowledgments\n\n- Thanks to all our contributors\n- Built with ❤️ by Panther Labs\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpanther-labs%2Fpypanther","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpanther-labs%2Fpypanther","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpanther-labs%2Fpypanther/lists"}