Rule unit test
A rule unit test runs a detection against a small set of sample events and checks whether it alerts on the ones it should and stays quiet on the others. It checks logic, not production behaviour. Tests live beside the rule in the repository and run in the pipeline.
What Rule unit test means here
A good test has at least one event that must match and one near miss that must not. Panther's docs set no minimum number of tests, so the discipline is the team's.
Unit tests do not tell you how a rule behaves on real volume. Pair them with replay on historical data before you enable a rule.
Example of Rule unit test in Panther documentation
Panther's testing docs describe unit tests with test events and an expected alert outcome, and state that Panther sets no minimum number of tests per detection. docs.panther.com read 2026-11-03
Terms related to Rule unit test
- Replay: Replay runs a rule over historical data to see what it would have alerted on.
- CI pipeline: A CI pipeline is the automated sequence that runs on each change to the rule repository: lint, validate, test and, on merge, deploy.
- Synthetic event: A synthetic event is a log record generated to look like the result of a specific attack behaviour, used to test whether a detection fires.
The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.