Hacker News Reader

Fails the "what is it?" test. I don't really care to dig around. Anyone want to enlighten me and all the others who read this who have no idea: what is a detection?

Sorry about that. We've now added a new section in the blog explaining more about Detections. Thanks!

a detection is typically a rule that describes known bad or suspicious behaviour. all simple rule would just be a list of malware hashes or domain names

so instead of writing rules using tools such as YARA: https://github.com/fireeye/sunburst_countermeasures/blob/mai... (sunburst) they want to write them in python

panther looks very interesting

i'm trying to evaluate solutions in this space and these are the ones i am aware of: chronicle security, panther and grapl

otherwise i have seen teams build their custom platform using databricks (apple did this), snowflake, or some other cloud-native data warehouse/lake

any others around?

FYI Panther can also integrate to Snowflake as the data backend

Seems like a Python only tool.

AWS CodeGuru is Java only, AFAIK.

Anyone knows good JavaScript/TypeScript tools?

Panther uses Python for real-time log analysis and SQL for analytics over the stored/normalized data.

Detections as Code