Panther

Panther scores 6.31 of 10, fourth of the 12 profiled, in band B with Splunk Enterprise Security (Cisco). It has the clearest Python detection workflow in the set: a CLI, GitHub Actions deploys and unit tests. Rule health and pricing are not documented. Databricks has agreed to acquire it, and it still ships as Panther.

Rubric total

6.31 of 10, fourth of 14 scored, fourth of 12 profiled

Matrix score

18.0 of 33 (14 documented, 8 partial, 11 not documented)

Rule health

1 documented, 2 partial of 5 matrix rule-health columns

Ownership

Independent company, Databricks (agreed acquisition, not confirmed complete). Databricks agreed to acquire Panther Labs, announced 16 June 2026. One investor profile says the deal completed on 3 August 2026; no second source confirms completion. Mark as acquired only after Databricks or Panther confirms closing. securityboulevard.com read 2026-11-03

Website

panther.com

What Panther is

Panther is a SIEM and AI SOC platform. Detections are Python: rules, scheduled rules and correlation rules, plus a Simple Detection Builder and an AI Detection Builder in beta (Panther docs, read 2026-11-03). The panther-analysis repository is Apache 2.0 and holds the built-in content. Sigma rules convert to Panther detections through sigma-cli.

Databricks agreed to acquire Panther Labs, announced 2026-06-16 (Security Boulevard, read 2026-11-03). On 2026-11-04 panther.com says Databricks has acquired Panther, that existing customers stay supported and that a move into Databricks Lakewatch is planned (vendor claim). One investor profile gives the close as 2026-08-03 and no second source confirms it. The product still ships as Panther. The workflow runs through the panther_analysis_tool CLI, with test, validate, zip, upload and delete commands.

Vendor description: Panther is a SIEM and AI SOC platform that normalises logs, runs detections written as Python and managed in version control, and adds AI agents for alert triage and investigation. Detection content is public on GitHub under Apache 2.0. panther.com read 2026-11-03 vendor claim

How Panther scores on the rubric

6.31 of 10 across eight weighted criteria. It sits in band B with Splunk Enterprise Security (Cisco): totals within 0.25 are a band, not a ladder. Each score has its reason and the page it was read from. The rubric explains the bands.

Panther on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.

The 33 capabilities for Panther

documentedpartialnot documented

Notes and sources for each cell are on the group pages: Languages, Source control and CI, Testing, Coverage analytics, Rule health, Library.

Where Panther is strong

• panther_analysis_tool runs lint and test in a GitHub Actions workflow, deploys through CircleCI or GitHub Actions, and uploads with an API token. A fork-and-pull flow for upstream content is documented. github.com read 2026-11-04
• Unit tests take test events and an expected alert outcome and run with panther_analysis_tool test. Data Replay, in beta, tests a rule against historical log data before you enable it. docs.panther.com read 2026-11-03
• Detections are Python, and the Converting Sigma Rules page documents sigma-cli turning Sigma into Panther Simple or Python detections. docs.panther.com read 2026-11-03

Where Panther is behind

• Rule errors fire when detection code raises or a scheduled rule runs over 15 seconds, but the docs describe no noisy-rule detection and no runtime cost telemetry. docs.panther.com read 2026-11-03
• The pricing page states no model, unit or price. panther.com read 2026-11-03
• Neither the repository page nor the home page states a count of detections, so library size cannot be checked. github.com read 2026-11-03

What only Panther publishes

The panther_analysis_tool benchmark command performance-tests one rule against one of its log types before deploy, though no runtime telemetry is described. docs.panther.com read 2026-11-03

Pricing as published for Panther

Not published. The pricing page states no model, unit or price. Two deployment options are shown: Panther Cloud (fully managed) and bring-your-own AWS with Databricks or Snowflake. panther.com read 2026-11-03

Named customers of Panther

Names below are as the source page lists them.

Customers named on public pages. Every name is a vendor claim from the page cited in its row.

Recent releases and news for Panther

• 2026-06-16 Databricks agrees to acquire Panther Labs. Reported by trade press on the announcement date; terms undisclosed. securityboulevard.com read 2026-11-03

Claims Panther makes about itself

Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.

Vendor claims with the evidence grade and who measured.

Shortlist Panther when

• Your team writes detections in Python and wants them tested and deployed from GitHub Actions.
• You want to convert Sigma rules into a SIEM that documents the conversion step.
• You can accept an ownership change in progress and will ask about price in a sales call.

Verdict on Panther

Fourth of 12 at 6.31, in band B with Splunk Enterprise Security (Cisco) (6.21), and joint top with Sentinel on git and CI (9.0), but rule health sits at 3.5.

Compare Panther

Alternatives to Panther. Head-to-head diffs: SOC Prime, Anvilogic, Sigma and pySigma, Detecteam, Elastic Security, Splunk Enterprise Security (Cisco), Sekoia.io, Hunters, Google Security Operations, Microsoft Sentinel, Mate Security.