Panther

Add a comment to a Panther alert. Comments support Markdown formatting.

Returns: Dict containing:

• success: Boolean indicating if the comment was added successfully
• comment: Created comment information if successful
• message: Error message if unsuccessful

Permissions:{'all_of': ['Manage Alerts']}

Bulk update multiple alerts with status, assignee, and/or comment changes.

This tool allows you to efficiently update multiple alerts at once by setting their status, assignee, and adding a comment. At least one of status, assignee_id, or comment must be provided.

Returns: Dict containing:

• success: Boolean indicating overall success
• results: Dict with operation results:
• status_updates: List of alert IDs successfully updated with new status
• assignee_updates: List of alert IDs successfully updated with new assignee
• comments_added: List of alert IDs that successfully received comments
• failed_operations: List of failed operations with error details
• summary: Dict with counts of successful and failed operations
• message: Error message if unsuccessful

Permissions:{'all_of': ['Manage Alerts']}

Disable a Panther detection by setting enabled to false.

Permissions:{'any_of': ['Manage Rules', 'Manage Policies']}

Retrieve the latest AI triage summary for a specific Panther alert.

This tool retrieves the most recently generated AI triage analysis for an alert. It fetches the list of AI inference stream IDs associated with the alert, then retrieves the response text for the latest stream.

Returns: Dict containing:

• success: Boolean indicating if retrieval was successful
• summary: The latest AI triage summary containing:
• stream_id: The unique stream identifier
• response_text: The AI-generated triage summary
• finished: Whether the triage generation completed
• error: Any error message if present
• message: Error message if unsuccessful

Permissions:{'all_of': ['Run Panther AI']}

Get detailed information about a specific Panther alert by ID

Permissions:{'all_of': ['Read Alerts']}

Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based groups.

For each time window (configurable from 1-60 minutes), the tool collects unique entities (IPs, emails, usernames, trace IDs) and alert metadata (IDs, rules, severities) to help identify related activities.

Results are ordered chronologically with the most recent first, helping analysts identify temporal patterns, common entities, and potential incident scope.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• status: Status of the query (e.g., "succeeded", "failed", "cancelled")
• message: Error message if unsuccessful
• results: List of query result rows
• column_info: Dict containing column names and types
• stats: Dict containing stats about the query
• has_next_page: Boolean indicating if there are more results available
• next_cursor: Cursor for fetching the next page of results, or null if no more pages

Permissions:{'all_of': ['Query Data Lake']}

Get events for a specific Panther alert. Order of events is not guaranteed. This tool does not support pagination to prevent long-running, expensive queries.

Returns: Dict containing:

• success: Boolean indicating if the request was successful
• events: List of most recent events if successful
• message: Error message if unsuccessful

Permissions:{'all_of': ['Read Alerts']}

Retrieves data ingestion metrics showing total bytes processed per log type and source, helping analyze data volume patterns.

Returns: Dict:

• success: Boolean indicating if the query was successful
• bytes_processed: List of series with breakdown by log type and source
• total_bytes: Total bytes processed in the period
• start_date: Start date of the period
• end_date: End date of the period
• interval_in_minutes: Grouping interval for the metrics

Permissions:{'all_of': ['Read Panther Metrics']}

Get detailed information about a Panther data model, including the mappings and body

Returns complete data model information including Python body code and UDM mappings.

Permissions:{'all_of': ['View Rules']}

Get detailed information about a Panther detection, including the detection body and tests.

Permissions:{'all_of': ['View Rules', 'View Policies']}

Get detailed information about a Panther global helper by ID

Returns complete global helper information including Python body code and usage details.

Permissions:{'all_of': ['View Rules']}

Get detailed information about a specific HTTP log source by ID.

HTTP log sources are used to collect logs via HTTP endpoints/webhooks. This tool provides detailed configuration information for troubleshooting and monitoring HTTP log source integrations.

Args: source_id: The ID of the HTTP log source to retrieve

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• source: HTTP log source information if successful, containing:
• integrationId: The source ID
• integrationLabel: The source name/label
• logTypes: List of log types this source handles
• logStreamType: Stream type (Auto, JSON, JsonArray, etc.)
• logStreamTypeOptions: Additional stream type configuration
• authMethod: Authentication method (None, Bearer, Basic, etc.)
• authBearerToken: Bearer token if using Bearer auth
• authUsername: Username if using Basic auth
• authPassword: Password if using Basic auth
• authHeaderKey: Header key for HMAC/SharedSecret auth
• authSecretValue: Secret value for HMAC/SharedSecret auth
• authHmacAlg: HMAC algorithm if using HMAC auth
• message: Error message if unsuccessful

Permissions:{'all_of': ['View Log Sources']}

Get detailed information for specific log type schemas, including their full specifications. Limited to 5 schemas at a time to prevent response size issues.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• schemas: List of schemas, each containing:
• name: Schema name (Log Type)
• description: Schema description
• spec: Schema specification in YAML/JSON format
• version: Schema version number
• revision: Schema revision number
• isArchived: Whether the schema is archived
• isManaged: Whether the schema is managed by a pack
• isFieldDiscoveryEnabled: Whether automatic field discovery is enabled
• referenceURL: Optional documentation URL
• discoveredSpec: The schema discovered spec
• createdAt: Creation timestamp
• updatedAt: Last update timestamp
• message: Error message if unsuccessful

Permissions:{'all_of': ['View Rules']}

Get the current user's permissions. Use this to diagnose permission errors and determine if a new API token is needed.

Get detailed information about a Panther role by ID

Returns complete role information including all permissions and settings.

Permissions:{'all_of': ['Read User Info']}

Gets alert metrics grouped by detection rule for ALL alert types, including alerts, detection errors, and system errors within a given time period. Use this tool to identify hot spots in alerts and use list_alerts for specific alert details.

Returns: Dict:

• alerts_per_rule: List of series with entityId, label, and value
• total_alerts: Total number of alerts in the period
• start_date: Start date of the period
• end_date: End date of the period
• interval_in_minutes: Grouping interval for the metrics
• rule_ids: List of rule IDs if provided

Permissions:{'all_of': ['Read Panther Metrics']}

Get detailed information about a specific scheduled query by ID.

Returns complete scheduled query information including SQL, schedule configuration, and metadata.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• query: Scheduled query information if successful, containing:
• id: Query ID
• name: Query name
• description: Query description
• sql: The SQL query text
• schedule: Schedule configuration (cron, rate, timeout)
• managed: Whether the query is managed by Panther
• createdAt: Creation timestamp
• updatedAt: Last update timestamp
• message: Error message if unsuccessful

Permissions:{'all_of': ['Query Data Lake']}

Gets alert metrics grouped by severity for rule and policy alert types within a given time period. Use this tool to identify hot spots in your alerts, and use the list_alerts tool for specific details. Keep in mind that these metrics combine errors and alerts, so there may be inconsistencies from what list_alerts returns.

Returns: Dict:

• alerts_per_severity: List of series with breakdown by severity
• total_alerts: Total number of alerts in the period
• start_date: Start date of the period
• end_date: End date of the period
• interval_in_minutes: Grouping interval for the metrics

Permissions:{'all_of': ['Read Panther Metrics']}

Get column details for a specific data lake table.

IMPORTANT: This returns the table structure in Snowflake. For writing optimal queries, ALSO call get_panther_log_type_schema() to understand:

• Nested object structures (only shown as 'object' type here)
• Which fields map to p_any_* indicator columns
• Array element structures

Example workflow:

1. get_panther_log_type_schema(["AWS.CloudTrail"]) - understand structure
2. get_table_schema("panther_logs.public", "aws_cloudtrail") - get column names/types
3. Write query using both: nested paths from log schema, column names from table schema

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• name: Table name
• display_name: Table display name
• description: Table description
• log_type: Log type
• columns: List of columns, each containing:
• name: Column name
• type: Column data type
• description: Column description
• message: Error message if unsuccessful

Permissions:{'all_of': ['Query Data Lake']}

Get detailed information about a Panther user by ID

Returns complete user information including email, names, role, authentication status, and timestamps.

Permissions:{'all_of': ['Read User Info']}

Get all comments for a specific Panther alert.

Returns: Dict containing:

• success: Boolean indicating if the request was successful
• comments: List of comments if successful, each containing:
• id: The comment ID
• body: The comment text
• createdAt: Timestamp when the comment was created
• createdBy: Information about the user who created the comment
• format: The format of the comment (HTML or PLAIN_TEXT or JSON_SCHEMA)
• message: Error message if unsuccessful

List alerts from Panther with comprehensive filtering options

Args: start_date: Optional start date in ISO 8601 format (e.g. "2024-03-20T00:00:00Z") end_date: Optional end date in ISO 8601 format (e.g. "2024-03-21T00:00:00Z") severities: Optional list of severities to filter by (e.g. ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"]) statuses: Optional list of statuses to filter by (e.g. ["OPEN", "TRIAGED", "RESOLVED", "CLOSED"]) cursor: Optional cursor for pagination from a previous query detection_id: Optional detection ID to filter alerts by. If not provided, default date range (7days) is applied. event_count_max: Optional maximum number of events that returned alerts must have event_count_min: Optional minimum number of events that returned alerts must have log_sources: Optional list of log source IDs to filter alerts by log_types: Optional list of log type names to filter alerts by name_contains: Optional string to search for in alert titles page_size: Number of results per page (default: 25, maximum: 50) resource_types: Optional list of AWS resource type names to filter alerts by subtypes: Optional list of alert subtypes. Valid values depend on alert_type:

• When alert_type="ALERT": ["POLICY", "RULE", "SCHEDULED_RULE"]
• When alert_type="DETECTION_ERROR": ["RULE_ERROR", "SCHEDULED_RULE_ERROR"]
• When alert_type="SYSTEM_ERROR": subtypes are not allowed alert_type: Type of alerts to return (default: "ALERT"). One of:
• "ALERT": Regular detection alerts
• "DETECTION_ERROR": Alerts from detection errors
• "SYSTEM_ERROR": System error alerts

Permissions:{'all_of': ['Read Alerts']}

List all data models from your Panther instance. Data models are used only in Panther's Python rules to map log type schema fields to a unified data model. They may also contain custom mappings for fields that are not part of the log type schema.

Returns paginated list of data models with metadata including mappings and log types.

Permissions:{'all_of': ['View Rules']}

List all available tables in a Panther Database.

Required: Only use valid database names obtained from list_databases

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• tables: List of tables, each containing:
• name: Table name
• description: Table description
• log_type: Log type
• database: Database name
• message: Error message if unsuccessful

Permissions:{'all_of': ['Query Data Lake']}

List all available datalake databases in Panther.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• databases: List of databases, each containing:
• name: Database name
• description: Database description
• message: Error message if unsuccessful

Permissions:{'all_of': ['Query Data Lake']}

List detections from your Panther instance with support for multiple detection types and filtering.

Note: The output_ids filter is applied client-side after fetching all results from the API, as the Panther REST API does not support server-side filtering by outputID. For more efficient API-level filtering, consider using the 'tag' parameter if your detections are tagged by environment.

Permissions:{'all_of': ['View Rules', 'View Policies']}

List all global helpers from your Panther instance. Global helpers are shared Python functions that can be used across multiple rules, policies, and other detections.

Returns paginated list of global helpers with metadata including descriptions and code.

Permissions:{'all_of': ['View Rules']}

List log sources from Panther with optional filters.

Permissions:{'all_of': ['View Rules']}

List all available log type schemas in Panther. Schemas are transformation instructions that convert raw audit logs into structured data for the data lake and real-time Python rules.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• schemas: List of schemas, each containing:
• name: Schema name (Log Type)
• description: Schema description
• revision: Schema revision number
• isArchived: Whether the schema is archived
• isManaged: Whether the schema is managed by a pack
• referenceURL: Optional documentation URL
• createdAt: Creation timestamp
• updatedAt: Last update timestamp
• message: Error message if unsuccessful

Permissions:{'all_of': ['View Log Sources']}

List all roles from your Panther instance.

Returns list of roles with metadata including permissions and settings.

Permissions:{'all_of': ['Read User Info']}

List all scheduled queries from your Panther instance.

Scheduled queries are SQL queries that run automatically on a defined schedule for recurring analysis, reporting, and monitoring tasks.

Note: SQL content is excluded from list responses to prevent token limits. Use get_scheduled_query() to retrieve the full SQL for a specific query.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• queries: List of scheduled queries if successful, each containing:
• id: Query ID
• name: Query name
• description: Query description
• schedule: Schedule configuration (cron, rate, timeout)
• managed: Whether the query is managed by Panther
• createdAt: Creation timestamp
• updatedAt: Last update timestamp
• total_queries: Number of queries returned
• has_next_page: Boolean indicating if more results are available
• next_cursor: Cursor for fetching the next page of results
• message: Error message if unsuccessful

Permissions:{'all_of': ['Query Data Lake']}

List all Panther user accounts.

Returns: Dict containing:

• success: Boolean indicating if the query was successful
• users: List of user accounts if successful
• total_users: Number of users returned
• has_next_page: Boolean indicating if more results are available
• next_cursor: Cursor for fetching the next page of results
• message: Error message if unsuccessful

Permissions:{'all_of': ['Read User Info']}

Query Panther's security data lake using SQL for log analysis and threat hunting.

REQUIRED: Include time filter with p_event_time (required for performance and partitioning)

Panther Time Filter Macros (Recommended - optimized for performance):

• p_occurs_since(timeOffset [, tableAlias[, column]]) Examples: p_occurs_since('1 d'), p_occurs_since('6 h'), p_occurs_since('2 weeks'), p_occurs_since(3600) Time formats: '30 s', '15 m', '6 h', '2 d', '1 w' OR '2 weeks', '1 day' OR numeric seconds

• p_occurs_between(startTime, endTime [, tableAlias[, column]]) Examples: p_occurs_between('2024-01-01', '2024-01-02'), p_occurs_between('2024-03-20T00:00:00Z', '2024-03-20T23:59:59Z')

• p_occurs_around(timestamp, timeOffset [, tableAlias[, column]]) Example: p_occurs_around('2024-01-15T10:30:00Z', '1 h') # ±1 hour around timestamp

• p_occurs_after(timestamp [, tableAlias[, column]])
• p_occurs_before(timestamp [, tableAlias[, column]])

Alternative (manual): WHERE p_event_time >= '2024-01-01' AND p_event_time < '2024-01-02'

Best Practices:

• Always use time filters (macros preferred over manual p_event_time conditions)
• Start with summary queries, then drill down to specific timeframes
• Use p_any_* fields for faster correlation (p_any_ip_addresses, p_any_usernames, p_any_emails)
• Query specific fields instead of SELECT * for better performance

Pagination:

• First call: No cursor parameter - returns first page with max_rows results
• Subsequent calls: Use next_cursor from previous response to get next page
• Continue until has_next_page is False

Common Examples:

• Recent failed logins: "SELECT * FROM panther_logs.public.aws_cloudtrail WHERE p_occurs_since('1 d') AND errorcode IS NOT NULL"
• IP activity summary: "SELECT sourceippaddress, COUNT(*) FROM panther_logs.public.aws_cloudtrail WHERE p_occurs_since('6 h') GROUP BY sourceippaddress"
• User correlation: "SELECT * FROM panther_logs.public.aws_cloudtrail WHERE p_occurs_since('2 h') AND ARRAY_CONTAINS('user@domain.com'::VARIANT, p_any_emails)"
• Nested field access: "SELECT p_enrichment:ipinfo_privacy:"context.ip_address" FROM table WHERE p_occurs_since('1 h')"

Query Syntax (Snowflake SQL):

• Access nested JSON: column:field.subfield
• Quote special characters: column:"field name" or p_enrichment:"context.ip_address"
• Array searches: ARRAY_CONTAINS('value'::VARIANT, array_column)

Returns: Dict with query results:

• results: List of matching rows (paginated based on cursor parameter)
• results_truncated: True if results were truncated (only for non-paginated requests)
• total_rows_available: Total rows found (for non-paginated requests)
• has_next_page: True if more results are available
• next_cursor: Cursor for next page (use in subsequent call)
• column_info: Column names and data types
• stats: Query performance metrics (execution time, bytes scanned)
• success/status/message: Query execution status

Permissions:{'all_of': ['Query Data Lake']}

Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations.

This tool initiates Panther's embedded AI agent to triage an alert and provide an intelligent report about the events, risk level, potential impact, and recommended next steps for investigation.

The AI triage includes analysis of:

• Alert metadata (severity, detection rule, timestamps)
• Related events and logs (if available)
• Comments from previous investigations
• Contextual security analysis and recommendations

Returns: Dict containing:

• success: Boolean indicating if triage was generated successfully
• summary: The AI-generated triage summary text
• stream_id: The stream ID used for this analysis
• metadata: Information about the analysis request
• message: Error message if unsuccessful

Permissions:{'all_of': ['Run Panther AI']}

Update the assignee of one or more alerts through the assignee's ID.

Returns: Dict containing:

• success: Boolean indicating if the update was successful
• alerts: List of updated alert IDs if successful
• message: Error message if unsuccessful

Permissions:{'all_of': ['Manage Alerts']}

Update the status of one or more Panther alerts.

Returns: Dict containing:

• success: Boolean indicating if the update was successful
• alerts: List of updated alert IDs if successful
• message: Error message if unsuccessful

Permissions:{'all_of': ['Manage Alerts']}