Panther vs Sekoia.io
Panther totals 6.31 and Sekoia totals 3.46 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Panther leads by 2.85 points. The pair turns on testing: Panther documents it in full, and Sekoia documents it only in part, or as a vendor claim. Neither publishes anything on pricing.
The difference that decides this pair
The largest weighted gap on the rubric is Git-native workflow and CI/CD: Panther scores 9.0 against 3.5 for Sekoia.io, which is 0.99 of the 10 point total.
On testing, Panther runs per-detection unit tests with panther_analysis_tool test and previews a rule on stored logs with Data Replay (Beta), while Sekoia tests a Sigma pattern against historical data in a rule testing view, with results that are not saved as a report. docs.panther.com read 2026-11-03 docs.sekoia.com read 2026-11-03
Rubric side by side
Panther totals 6.31 and Sekoia.io totals 3.46 out of 10.
Rubric criteria for Panther and Sekoia.io, scores out of 10. A plus marks a criterion where Sekoia.io scores higher, a minus where Panther does.
| Marker | Criterion | Weight | Panther | Sekoia.io |
|---|---|---|---|---|
| - | Rule languages and conversion paths | 15 | 8.0 | 4.0 |
| - | Git-native workflow and CI/CD | 18 | 9.0 | 3.5 |
| - | Testing | 15 | 8.0 | 3.5 |
| - | Coverage analytics | 12 | 5.0 | 3.5 |
| - | Rule health | 18 | 3.5 | 3.0 |
| - | Versioning and rollback | 8 | 6.0 | 3.0 |
| - | Content library size and freshness | 8 | 5.0 | 4.0 |
| Pricing transparency | 6 | 3.0 | 3.0 | |
| Total | 100 | 6.31 | 3.46 |
The 33 capabilities as a diff
Read it as a diff from Panther to Sekoia.io: 16 of 33 rows differ. A plus marks a row where Sekoia.io documents more (4 rows), a minus a row where Panther documents more (12 rows). Rows with no marker match.
Capability rows for Panther and Sekoia.io, grouped. Changed rows are shaded and carry a marker.
| Marker | Capability | Panther | Sekoia.io |
|---|---|---|---|
| Languages | |||
| Sekoia.io documents more | Sigma native | not documented | documented |
| Panther documents more | Sigma conversion | documented | not documented |
| YARA-L | not documented | not documented | |
| SPL | not documented | not documented | |
| KQL | not documented | not documented | |
| EQL or ES|QL | not documented | not documented | |
| Panther documents more | Python | documented | not documented |
| Panther documents more | Visual builder | documented | not documented |
| YARA | not documented | not documented | |
| Lucene or KQL-like | partial | partial | |
| Source control and CI | |||
| Panther documents more | Git sync | documented | not documented |
| Panther documents more | PR deploy | documented | not documented |
| Panther documents more | CLI | documented | not documented |
| Rule API | documented | documented | |
| Panther documents more | CI examples | documented | not documented |
| Env promotion | not documented | not documented | |
| Testing | |||
| Panther documents more | Unit tests | documented | partial |
| Replay | documented | documented | |
| Synthetic events | not documented | not documented | |
| Backtest reports | partial | partial | |
| Test coverage | not documented | not documented | |
| Coverage analytics | |||
| ATT&CK map | documented | documented | |
| Panther documents more | Gap view | documented | partial |
| Data sources | partial | partial | |
| Log source health | partial | partial | |
| Rule health | |||
| Sekoia.io documents more | Noisy rules | not documented | partial |
| Panther documents more | Broken rules | documented | partial |
| Panther documents more | Field drift | partial | not documented |
| Rule cost | partial | partial | |
| Sekoia.io documents more | Lifecycle | not documented | documented |
| Library | |||
| Sekoia.io documents more | Library count | partial | documented |
| Panther documents more | Community | documented | not documented |
| Cadence | partial | partial | |
documentedpartialnot documented
Sources for the rows that differ
- Sigma native (Sekoia.io documents more). Panther: not documented, No page read for this platform names this feature docs.panther.com read 2026-11-03. Sekoia.io: documented, 'Sigma Rules' page: native Sigma YAML, including event_count, value_count and temporal correlation docs.sekoia.com read 2026-11-03.
- Sigma conversion (Panther documents more). Panther: documented, 'Converting Sigma Rules': sigma-cli converts Sigma rules to Panther Simple or Python detections docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Python (Panther documents more). Panther: documented, 'Writing Python Detections'; rules, policies and scheduled rules docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Visual builder (Panther documents more). Panther: documented, 'Using the Simple Detection Builder' and 'AI Detection Builder (Beta)' in the Console docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Git sync (Panther documents more). Panther: documented, 'Using panther-analysis' repo setup and 'Setting Up the Panther GitHub App (Beta)' docs.panther.com read 2026-11-03. Sekoia.io: not documented, Git module action triggers playbooks on repository file changes; no rule sync documented docs.sekoia.com read 2026-11-03.
- PR deploy (Panther documents more). Panther: documented, 'Managing Panther Content via GitHub Actions': automate testing and upload from the repo to the Console docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- CLI (Panther documents more). Panther: documented, Panther Analysis Tool commands test, validate, zip, upload, delete docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- CI examples (Panther documents more). Panther: documented, Workflow YAML for GitHub Actions and CircleCI; no GitLab CI page in the docs index docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Unit tests (Panther documents more). Panther: documented, 'Testing': unit tests with test events and expected alert outcome; Panther sets no minimum number of tests docs.panther.com read 2026-11-03. Sekoia.io: partial, 'Rule testing' with 'Test pattern' on historical data; no sample-event test cases docs.sekoia.com read 2026-11-03.
- Gap view (Panther documents more). Panther: documented, MITRE ATT&CK tab on the Dashboard shows Covered, Partially Covered, Not Relevant per technique docs.panther.com read 2026-11-03. Sekoia.io: partial, Matrix cells colored by rule count; gaps are inferred from empty cells, no gap report named docs.sekoia.com read 2026-11-03.
- Noisy rules (Sekoia.io documents more). Panther: not documented, No page read for this platform names this feature docs.panther.com read 2026-11-03. Sekoia.io: partial, 'Alert similarity' groups repeat matches 'rather than flooding the alert list'; 'Alert filters'; threshold tuning guidance docs.sekoia.com read 2026-11-03.
- Broken rules (Panther documents more). Panther: documented, 'Rule errors and scheduled rule errors' raised when detection code raises or a scheduled rule runs over 15 seconds docs.panther.com read 2026-11-03. Sekoia.io: partial, 'Lag management' keeps SOL rules from missing late events; no failed-rule alerting on pages read docs.sekoia.com read 2026-11-03.
- Field drift (Panther documents more). Panther: partial, System Errors include 'Log Classification Errors' for logs that fail schemas; not tied to rule fields docs.panther.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Lifecycle (Sekoia.io documents more). Panther: not documented, No page read for this platform names this feature docs.panther.com read 2026-11-03. Sekoia.io: documented, 'Rule Lifecycle': Active, Scheduled for Deprecation, Deprecated, with valid-until date and notifications docs.sekoia.com read 2026-11-03.
- Library count (Sekoia.io documents more). Panther: partial, 'Using Panther-managed Detections' describes out-of-the-box Python detections; no count on page docs.panther.com read 2026-11-03. Sekoia.io: documented, Sekoia Verified Rules: 'more than 1000 rules' docs.sekoia.com read 2026-11-03.
- Community (Panther documents more). Panther: documented, panther-analysis README: all detections developed by the Panther Team and the Community, contributing guidelines raw.githubusercontent.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
Verdict by buyer type
Which of the two fits each kind of team.
| Buyer | Verdict |
|---|---|
| a team starting from scratch with Sigma | Both document a route: Panther converts Sigma with sigma-cli into Python or Simple detections and tests them in CI, and Sekoia runs native Sigma YAML, correlation rules included, but documents no CI workflow, so the difference above decides. |
| Microsoft Sentinel estate | Neither Panther nor Sekoia documents a path for this buyer, so it does not separate them. |
| Elastic estate | Neither Panther nor Sekoia documents a path for this buyer, so it does not separate them. |
When to pick each
Panther: Pick Panther when testing is the deciding need: it runs per-detection unit tests with panther_analysis_tool test and previews a rule on stored logs with Data Replay (Beta). It also leads on CI and deployment.
Sekoia.io: Pick Sekoia when versioning and lifecycle is the deciding need: it documents rule states Active, Scheduled for Deprecation and Deprecated with a valid-until date. It also leads on library size.
Profiles: Panther, Sekoia.io. Alternatives: to Panther, to Sekoia.io.