Welcome to "Powered by Snowflake,"
where I interview technology leaders,
building businesses,
and applications on Snowflake.
I'm your host, Daniel Myers.
And today, I'm talking with Will Lowe,
Chief Operating Officer of Panther.
Panther is a real-time threat detection, investigation,
and incident response platform,
and it's Powered by Snowflake.
Will, how are you today?
I'm great. Thanks for having me Daniel.
I'm excited to be chatting with you today.
And really to kick this off,
I want to learn more about you, your background,
and in your own words, describe what does Panther do?
My background was in identity and access management.
I spent about eight years building a company called Gluu,
and we served a number of universities,
federal government agencies,
large consumer electronics providers.
And that was my real introduction,
both to enterprise IT, as well as security.
I've been with Panther for about two years.
I stood up the business there.
Panther is a data platform for security, essentially.
Security has really turned into a data problem.
Our security practitioners are drowning in data,
and Panther provides them
the big data foundation and infrastructure,
and the developer-led principles
that they need to analyze that data,
and derive signal from all of that noise.
It's really interesting
that you mentioned that
security has become a data-centric problem.
Right.
I see that more and more across all industries.
Tell me more about kind of the history of Panther.
When was it founded and how big is it today?
Panther was founded in August of 2018,
and it was really a spinoff
of an open source project at Airbnb.
So, the Founder and CEO, Jack Naglieri,
and his small security team at Airbnb,
they needed something new
that could keep up with the amount of data
that Airbnb was generating.
The existing tools on the market
just weren't built for that level of scale.
So Jack and team built this open source project
called StreamAlert at Airbnb.
They open-sourced it.
They ran it at Airbnb for a couple of years.
It started getting quite a bit of adoption in the community.
So companies like Coinbase, Duo, Intercom,
these high growth startups
really started gravitating towards this open source project,
and that was essentially the thesis
that there was a business opportunity here.
Jack, by kind of like good fortune,
met an investor who wanted to take a bet on him.
Pulled him out of a security department,
and gave him a million bucks to start the company.
That is a really, really cool origin story for Panther.
Tell me more about
how does Snowflake fit into this story?
And can you show me kind of a high-level diagram
of the tech stack that you've built?
Yeah.
So, Snowflake is at the center or the foundation
of the product that we've built.
As I mentioned, security has really turned
into a data problem.
And like you said, many, many industries
are starting to trend in this direction as well,
where we're both trying to deliver functional value,
but in order to do that with today's data scales,
we need the big data foundation that Snowflake provides.
So, Snowflake is essentially our DataCloud
that powers the whole product.
I can show you a quick diagram
about how Panther works on top of Snowflake.
If you take a look at my screen here,
you can see that we have our Cloud Data Sources on the left.
Panther pulls all of this data from your Cloud environments,
your host environments,
your networks, your applications, SaaS,
On-Premise, custom.
Pulls that through its processing engine.
It parses and normalizes this data.
Essentially, we have this raw data
that needs to get cleaned and formatted
in order for proper analysis to happen.
So, Panther does all of that in its processing pipelines,
and then it sends the data down into Snowflake
for long-term retention, investigations,
and contextual threat analysis.
That's pretty impressive.
Can you tell me more about some of the data sources,
and what types of data
are you gathering from these sources?
Primarily audit logs.
So, audit logs can contain the trail of information
that corresponds to the activity
that's happening inside of these systems.
So when a security event happens,
the first question that people wanna understand is...
or not the first,
but the first like five,
is who, what, when, where, why, right?
And you get this type of information from audit logs.
However, audit logs are notoriously verbose.
They're messy.
They can be very, very difficult for a human's brain
to literally parse and understand,
and so we have to have automation in this pipeline.
And the volume of these logs has gotten huge
as our environments have expanded.
So I think the common nomenclature is something like,
as systems move to the cloud, they get 10X noisier.
And so, as all of our organizations
have gone into the cloud,
we've just produced an abundance of new data
that security teams need to gather, collect,
retain for long periods of time.
I think every year Verizon puts out its breach report,
and typically, the numbers are around 270 days
until a security event is identified.
And so you start looking at these environments,
you say, "Okay, well, we're getting five, 10, 15 terabytes
of audit logs that we need to capture
and analyze every single day,
but we have to store these things for 270, 300 days,
sometimes up to seven years or 10 years,
based on industry regulations."
And so, this is just not possible
in a DIY type of Cloud Data Warehouse solution,
so we need big vendor, well supported,
well maintained platforms like Snowflake has provided.
It really seems
like the scale that Snowflake is able to provide
out of the box is a pretty core element
and required for your customers,
in order to leverage a product like Panther
A big part of security teams has been Ops teams.
You need Ops teams to manage tools like Splunk.
You need Ops teams to manage processing pipelines,
and this has become such a burden on organizations,
like the burden to getting any security insights
is standing up all this infrastructure.
And essentially Snowflake has enabled us and our customers
to get value very, very quickly from their data.
So, what you could do with a team of 20,
you can now do with a team of two.
That's impressive.
Can we see a live demo of it today?
Of course, of course.
I'd be happy to show you a live demo.
I always like to level set
with just a couple of quick slides.
So, as we had shown
this is a high level architecture overview.
So we have all of our data sources
that are coming through Panther,
parsing, normalizing, analyzing that data,
triggering out alerts to incident management systems
like PagerDuty or Slack or Asana,
wherever the security team wants to keep track
of their security events.
We take these raw logs.
So this is like a raw Web server log.
As you can see,
it'd be very difficult to find information from this log.
So Panther, parses, and normalizes this.
So we parse it, we take a raw log,
we turn it into a JSON object,
which makes it nice and pretty for us to read and review,
and then we standardize information and data,
that's going to be consistent
across a number of different types of sources.
So, you're gonna find IP addresses
pop up in a lot of systems.
You're gonna find domain names
log types, user names, email addresses.
That type of data we normalize for our teams.
And so what this enables you to do
is search data very quickly.
We're always looking for an IP address,
and where did that IP address pop up in the systems.
When we parse and normalize, we take that IP address,
we put it into a column in Snowflake,
and now when I look for that proverbial needle
in the haystack,
it's quite a bit easier for us to find.
Once we have parsed and normalized data,
we can now apply code to it effectively.
And this is one of the big value props of Panther
is that you can write these detections,
which trigger alerts
with extreme flexibility using Python.
So this enables you to
express a ton of custom business logic.
It allows you to bootstrap functionality
by using libraries, helpers, variables.
So you get all of these
developer best practices out of the box,
and you can analyze all of this data very efficiently.
So with that being said,
just a couple of things to level set,
I'll take you through the product,
and we can look through a couple of workflows.
When you step into the product,
you are shown an overview
that shows you some of your alerts,
and some of your most active detections.
We can go ahead and jump into one of these alerts,
and walk through the workflow of how we got there.
So here's an alert for a test administrator,
assuming a role from an unknown location.
So this is the type of thing
that a security team might want to know about.
We have it tagged as a low severity event,
because we're not going to raise a critical alarm
every time something like this happens,
but it is something
that our security team wants to log and be aware of.
In certain use cases,
we might send this to an automation system,
and have the automation system follow up
with the user and say,
this is recognized,
do you understand this?
Do you know who did this?
We can see that we had four events
that triggered this alert.
So, security teams see a lot of activity.
They don't want an alert for every piece of activity.
They want to de-duplicate all of those events
and collapse them into one alert.
Panther gives you the flexibility of doing this.
And we can see some of the data
that triggered some of these alerts.
So, some of these highlighted fields
are things that we might be interested in evaluating
to better understand what happened in the system.
So, if we look at an IP address,
which is a very very common indicator of compromise,
we can see that this came from 73.92.62.201,
and we can take a look at this IP address,
and see where else this popped up in our logs.
What other systems
did this IP address show up in?
We can set a couple of dates,
and I'll tab over because I have it,
I have it already ran.
You can see that we scanned
about 50 megabytes of data in 15 seconds,
and we found this IP address
popped up in a couple of different systems.
So it came up in our CloudTrail
in our logs, and in our rule matches.
So, essentially this IP address
was found in a couple of alerts,
and it was found in four log events.
If we wanted to drill in on this even further,
we could click one of these buttons,
and we could tab out,
and this will open up a Data Explorer Window,
that as you can see,
is Powered by Snowflake,
sitting right on top of Snowflake.
The SQL is pre-generated for you
but this is essentially a SQL workbook.
So you can customize this search,
you can pivot around,
and you can start investigating this type of activity.
This is pretty impressive
and exciting to see how Snowflake
really does power something like this.
It's everything.
And I love how you mentioned
finding that proverbial needle in the haystack, right?
And being able to do that
with this type of of Data Explorer,
the amount of data that you're able to to glean,
is really impressive.
Can you talk about and explain what in particular,
what was the types of considerations
that you had when evaluating Snowflake?
We were looking for a partner.
When we identified Snowflake as a partner,
it was not just a technical partner,
it was a go to market partner.
So we needed to find alignment in the vision,
that security really was a data problem
and Snowflake had that in spades.
So that was a really, really important
piece of the decision.
But, architecturally,
when we made this decision two-plus years ago, you know,
Snowflake was the best platform out on the market.
It still is today.
The architecture is great for scaling.
We love the fact that you can scale
up and down warehouses to make queries go faster.
So that's something that is really,
really important to security teams,
when they need an answer, they need an answer fast,
and they're happy to pay a few dollars more
to get that answer in five minutes
instead of five hours or five days.
The other part that's really interesting
in Snowflake is the ecosystem.
Your data is only as valuable as the context
that you can bring to it.
So if you have data on an island,
isolated data is not nearly as valuable as data
that's connected, that you can gather context
and enrich with other sources,
and Snowflake's Data Marketplace
is leading the pack in that respect.
That's awesome.
And I love that you mentioned the Data Marketplace.
I definitely see that also
throughout the industry,
the ability, just like you said, to join
and enrich that data is incredibly powerful,
and the data itself is only as valuable as the action
that you're able to take from it.
That context that you're able to provide.
What from here, you know,
six months, one year down the line,
what's next for Panther,
and what should your customers get excited about?
For us it's a matter of boiling in more simplicity
making these workflows effortless and elegant.
We've given teams a ton of flexibility
to go out and build the workflows
that are important to their business,
and that's one of the most important things
that we will keep,
but we also want to get people the value faster.
So we want to build more drag and drop workflows.
We want to expand
our catalog of data sources that we can pull in.
The more data that you can get in faster,
the faster that you can start analyzing data,
and understanding areas of vulnerability
and security posture.
So, getting more data into the system is super important.
Enrichments, how does all of this data make sense
with other data that's available
out there in the marketplace?
These are all really, really important initiatives
that we're working on
to make security a little bit easier
for the practitioners that have to live
and breathe this every day.
That is a really exciting vision
and roadmap for Panther.
For everybody watching here today,
where should they go to learn more about you,
and get in touch with Panther
Go to panther.com.
Brand new domain
that we just purchased a couple of months ago
after our series B.
So, should make it very, very easy to find us,
and go ahead and click one of those buttons
at the top of the navigation bar.
That's awesome.
Will, I want to thank you so much
for joining me here in the studio today,
and having this conversation.
It's exciting to see
everything that Panther's doing
the product that you've built
and the scalability that you're able to achieve
with Snowflake.
Thank you, Daniel.
I appreciate your time and thanks for all the hard work.
Awesome. And for everybody here today watching,
if you're looking to build your next application
on Snowflake,
check out developers.snowflake.com.
And be sure and check out the other videos that we have
for "Powered by Snowflake" here on YouTube.
Thanks.