Tech Partner Log Source Integrations

Integrate your product with Panther as a Tech Partner

This page provides instructions for Panther Technology Partners who are integrating their product with Panther by sending logs to one of Panther's Data Transport sources—for example, to an S3 bucket or an HTTP endpoint. If you need to create a log pulling integration instead, please work directly with the Panther Tech Partner team.

If you would instead like to create an Alert Destination integration, see Tech Partner Alert Destination Integrations. If you are a Panther customer looking for information on ingesting custom logs, please see the Custom Logs documentation.

Step 1: Contact Panther’s Tech Partner team

• Fill out this form to contact our Tech Partner team.

  • You will work with our Tech Partner team to get access to a test instance and a shared Slack channel.

Step 2: Determine the integration method(s)

• If your application can export events to an S3 bucket, please see the S3 Source instructions.

• If your data can use one of our other transport options, please see the individual Data Transport documentation pages.

The HTTP source is not recommended if your log source is high-volume (i.e., it emits at least one GB per hour) and/or its payload size exceeds the HTTP payload limit.

Step 3: Generate a schema and detections

1. Generate a schema for your data:

   1. Generate sample data.

   2. Infer a schema using your sample data.

      • You can infer a schema in the Panther Console or from the CLI using pantherlog.

   3. Export your schema.

      • You can export your schema from the CLI using pantherlog, or you can copy it from the Panther Console and paste it into a text file.

2. (Optional) Create detections for your log source.

   • This is strongly encouraged, as having detections available will promote adoption of your integration. Please contact Panther’s Tech Partner team for more information.

   • See detection examples in the panther-analysis GitHub repository.

Step 4: Write instructional information about the integration

Please create a text file with the following information, which will be used to describe your platform in the Panther Console and to generate a documentation page for this integration:

• A description of the application

• Common use cases

• The supported integration method(s)

• Any caveats or limitations

• Step-by-step instructions on how to make any necessary configurations in your application to forward logs from your service to the Data Transport source

  • For an example, see pages under Supported Logs that use Data Transports, such as Auth0 Logs and GitLab Logs

Step 5: Submit to Panther for review

1. Zip the files containing the following:

   • The text file of information from Step 4

   • A square .svg file of the application’s logo

   • Your test data

   • The schema

   • (Optional) The detections

2. Send the zipped file to Panther via your shared Slack channel.

After submitting your zip file, the Tech Partner team will work with you to coordinate next steps.