How do I check if my Panther rules are working?

QUESTION

How do I investigate if my rules are being applied? I did not see alerts trigger as expected.

ANSWER

You can check for rule matches in the Data Explorer. Using a query similar to the following will return a list of rule IDs and the number of the times they have triggered an alert in the timeframe provided. The example below checks for AWS Cloudtrail rule matches.

SELECT
  p_rule_id, count(p_rule_id)
FROM
  panther_rule_matches.public.aws_cloudtrail
WHERE
  p_occurs_since('48 hours')
GROUP BY p_rule_id