Sold by: PantherÂ
Deployed on AWS
Panther is a modern Security Information and Event Management (SIEM) tool that solves the challenges of security operations at scale.
Overview
Note: Listing is specific to Panther's Cloud Connected deployment model, which requires the customer to own AWS and Snowflake infrastructure and associated costs. For custom pricing, SaaS deployment options, EULA, private contract, or private offers please contact sales@panther.com .
The shift to the cloud has resulted in an explosion of data that security teams need to collect, analyze, and retain to detect threats. However, traditional security monitoring tools were never built with cloud-scale in mind and cannot meet the demands of today's modern workloads. Panther is an AWS cloud-native threat detection platform that transforms terabytes of raw logs per day into a structured security data lake to power real-time detection, swift incident response, and thorough investigations.
With detection-as-code in Python and out-of-the-box integrations for critical log sources including S3, CloudTrail, VPC Flow Logs and more - Panther solves the challenges of security operations at scale.
Highlights
- Detect threats immediately by analyzing logs as soon as they are ingested, giving you the fastest possible time to detection.
- Answer security questions quickly with the ability to immediately query months of data in minutes and efficiently search for IoCs across all logs.
- Reduce SIEM costs dramatically while gaining lightning-fast query speeds, with an efficient, highly scalable data lake architecture.
Details
Unlock automation with AI agent solutions
Fast-track AI initiatives with agents, tools, and solutions from AWS Partners.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Panther - 1TB/Month | Panther Cloud Connected - 1TB of Monthly Ingestion - 1 Year Data Retention | $50,000.00 |
Dimension | Cost/unit |
|---|---|
Details of overage can be found in EULA | $1.00 |
Vendor refund policy
Please reference EULA for refund policy
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA)Â .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
Panther support has been continuously praised by customers. See the SLA's page attached for further insight. support@panther.ioÂ
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Panther
By IBM Security
By CrowdStrike
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Log Analysis
Real-time security log processing and analysis of terabytes of raw logs per day using cloud-native architecture
Detection Methodology
Detection-as-code implementation using Python programming language for threat detection rules
Cloud Log Integration
Native integrations with AWS log sources including S3, CloudTrail, and VPC Flow Logs
Security Data Lake
Transforms raw log data into structured security data lake for comprehensive threat investigation and incident response
Scalable Architecture
Highly scalable data lake infrastructure designed for processing and querying large volumes of security logs efficiently
Threat Detection and Analytics
Advanced security information and event management (SIEM) solution with real-time monitoring and threat detection capabilities
Cloud Security Integration
Deep integration with AWS security services including Security Hub, CloudTrail, GuardDuty, Network Firewall, and VPC Flow Logs
Incident Response Automation
Enterprise-grade AI and automation to orchestrate and streamline incident response workflows across security technologies
Event Correlation
Ability to correlate data across users, networks, and cloud services to provide comprehensive threat insights and minimize alert fatigue
Multi-Environment Monitoring
Unified security analytics platform supporting monitoring and visibility across cloud and on-premises infrastructure
Cloud Security Posture Management
Unified cloud security management across AWS, Azure, and GCP with continuous monitoring and configuration assessment
Threat Detection and Response
Advanced threat intelligence and detection capabilities with real-time monitoring and response mechanisms for cloud environments
Container and Kubernetes Protection
Comprehensive security for containerized applications and Kubernetes environments with runtime protection and image security
Multi-Cloud Workload Security
End-to-end protection for cloud workloads across on-premises, hybrid, and multi-cloud infrastructure with a single lightweight agent
Event-Driven Security Automation
Dynamic cloud resource protection through integration with cloud service provider event and management services
Standard contract
No
No
No
Customer reviews
0 ratings
0 AWS reviews
|
33 external reviews
Star ratings include only reviews from verified AWS customers. External reviews can also include a star rating, but star ratings from external reviews are not averaged in with the AWS customer star ratings.
Filip S.
The best SIEM for Detection as a Code implemnetation
Reviewed on Jun 11, 2025
Review provided by G2
What do you like best about the product?
There are few key areas where Panther SIEM does an amazing job. First one is the easy way to onboard any log source, it can support various data format and ways to ingest logs, it allows you to easily create parsers and for the out of the box integrations it provides many pre-build detections. Detections can be either written in python or UI low-code builder. There are also capabilities to create scheduled searches and correlation rules. As far as investigation goes there is an AI investigation functionality that is quite good.
What do you dislike about the product?
Is bit limited on external enrichment providers. Is also limited on the Alert UI as it can't be customised, neither custom statuses can be created,
What problems is the product solving and how is that benefiting you?
Helping us with security monitoring coverage and threat detection and response.
Soumitr P.
Truly the next generation of Security Logging and Monitoring
Reviewed on Jun 05, 2025
Review provided by G2
What do you like best about the product?
Panther has completely imbibed the ethos of Security Data Lake in its product. This will define the future of how all SIEMs will operate. Gone are the days of imagining SIEMs as a pay per GB product where you can make some custom language rules. Security Analysis is essentially a data problem and Panther's approach to solving it is the best in the business.
From no nonsense connectors to stellar in built detections, Panther has it all. For companies with low capacity for custom in house detection engineering, it just works. For teams with dedicated detection engineering staff, all the tools to make you successful are available out of the box.
The old guard of the SIEM industry are dead and security data lake is the future, with Panther leading the pack in the new generation of security analysis providers.
From no nonsense connectors to stellar in built detections, Panther has it all. For companies with low capacity for custom in house detection engineering, it just works. For teams with dedicated detection engineering staff, all the tools to make you successful are available out of the box.
The old guard of the SIEM industry are dead and security data lake is the future, with Panther leading the pack in the new generation of security analysis providers.
What do you dislike about the product?
Only thing I want to see from Panther is for them to start offering a MSSP style solution and staffing a SOC to monitor my Panther alerts!
What problems is the product solving and how is that benefiting you?
Ingesting, analysing, and alerting on security logs so I can be aware of any security events/incidents that I should be investigating/following up on.
Information Technology and Services
Great SIEM With Lots of Out of the Box Detections
Reviewed on May 15, 2025
Review provided by G2
What do you like best about the product?
One of the things I like most about Panther is it's Python based detection rules. It easy to start with simple rule writing, but moving to writing more complex rules using Python is a breeze.
What do you dislike about the product?
As someone responsible for triaging alerts, I’ve found the UI a bit cumbersome—it’s missing some key quality-of-life features that would streamline triaging alerts. Integrating it with automation systems could unlock a lot of value to ease some of this.
What problems is the product solving and how is that benefiting you?
Panther handles log ingestion and normalization across cloud infrastructure without needing a heavy ELK stack or complex data plumbing. Panther makes it easier to focus on writing detections rather than operating a log ingestion infrastructure.
Marketing and Advertising
Great for Writing Detections
Reviewed on May 08, 2025
Review provided by G2
What do you like best about the product?
Writing detections in Python is super nice.
Being able to throw an indicator such as an IP address or username into Panther and having it search everywhere is convenient.
Being able to throw an indicator such as an IP address or username into Panther and having it search everywhere is convenient.
What do you dislike about the product?
When we make customizations to detection rules, it often causes merge conflicts when syncing from the upstream panther-analysis repo.
Custom SQL queries are often slow (on the order of 10 minutes).
Custom SQL queries are often slow (on the order of 10 minutes).
What problems is the product solving and how is that benefiting you?
Having our security relevant logs in one place where we can customize alerting and easily search during manual investigations.
Information Technology and Services
SaaS Security Operations
Reviewed on May 05, 2025
Review provided by G2
What do you like best about the product?
We've been using Panther for nearly two years, and it's been a fantastic experience. Their commercial team has been consistently fair and transparent, which made the onboarding process smooth and the long-term relationship easy to manage.
Support-wise, Panther has been exceptional — fast, knowledgeable, and genuinely helpful whenever we’ve needed them. What’s impressed us most, though, is the platform’s rapid evolution. Since we joined, Panther has rolled out a steady stream of valuable features and native integrations, showing their strong commitment to innovation and customer needs.
Panther has become a key part of our security stack, and we’re excited to see how the platform continues to grow.
Support-wise, Panther has been exceptional — fast, knowledgeable, and genuinely helpful whenever we’ve needed them. What’s impressed us most, though, is the platform’s rapid evolution. Since we joined, Panther has rolled out a steady stream of valuable features and native integrations, showing their strong commitment to innovation and customer needs.
Panther has become a key part of our security stack, and we’re excited to see how the platform continues to grow.
What do you dislike about the product?
We work with external consultants who are more familiar with traditional SIEM platforms, so there was a brief adjustment period for them when adapting to Panther’s approach. That said, once they understood the architecture and workflows, things went smoothly. Beyond that, there's very little to dislike — Panther has consistently delivered on both functionality and support.
What problems is the product solving and how is that benefiting you?
Panther solves our core needs around log aggregation, monitoring, and detection. It provides a scalable and efficient way to manage security events across our cloud infrastructure, with flexibility that fits our engineering-driven workflows. This has helped us streamline threat detection and response while keeping costs predictable.