Panos Sakkos

Threat hunting has traditionally required deep familiarity with query languages, log structures, and attacker behavior — a high bar that slows down even experienced engineers. In this hands-on workshop, we’ll explore what threat hunting actually looks like in practice using Panther, a modern SIEM platform, first without AI, then with it.

We’ll start by building detections and hunting for threats the manual way: writing PantherFlow and Python-based detection rules, querying structured log data, and reasoning through attacker patterns from first principles. Then we’ll layer in AI — showing how it accelerates query writing, explains unfamiliar log sources, and surfaces anomalies that would otherwise require significant domain expertise to catch.