Panther AI

Overview

Panther AI includes a set of generative AI features designed to accelerate your detection and response workflows. It operates with the persona of a security engineer and has access to many of the same tools available to human users of Panther.

Panther AI can quickly assess data, such as alerts and logs, to rapidly deliver insights. You can run predefined workflows or ask your own questions to Panther AI—it will leverage its available tools (such as querying the data lake) to answer them, generally much faster than a human analyst would be able to.

Watch video demos of various Panther AI workflows here.

Panther AI uses Claude AI models by Anthropic through Amazon Bedrock. Panther AI does not use your data for AI training—learn more about data security below.

When using Panther AI, you may want to view previous responses or rename, pin, save, or delete certain interactions. Learn how to perform these actions in Managing Panther AI Response History.

Use of Panther AI features is subject to the AI disclaimer found on the Legal page.

Using Panther AI agents in the Console

Find Panther AI in the Panther Console in the following locations:

• Panther AI

  • In the left-hand navigation bar, click Panther AI. Ask Panther AI anything—there is no context-dependent data being analyzed (like alerts or log events at the above entry points), so it's a good place to ask general security questions. Here, you'll see suggested and favorite prompts.

    
• Panther AI alert triage

  • AI alert triage: Gather information about and analyze an alert. You can run AI alert triage on demand, or enable auto-run, which runs AI alert triage on new alerts automatically.

  • Alert list AI triage: Triage multiple alerts in your alerts list at once.

  • When you triage one or more alerts, you will see a Risk Classification score.

• Panther AI search

  • Use AI to generate PantherFlow queries with natural language.

  • Search results AI summary: Summarize a set of result events.

• Panther AI Detection Builder

  • AI Detection Builder: Create and modify rules and scheduled rules with AI assistance directly in the rule editor. The AI Detection Builder can generate detection code, add test cases, and explain detection logic.

  • In a follow-up prompt to a Search results AI summary, you can direct Panther AI to, "Write a Panther detection for this activity."

  • In a follow-up prompt to an AI alert triage, you can ask Panther AI, "How should I tune the detection this alert was triggered by?"

  • On Detection detail pages, in the Overview tab, review the AI-generated summary.

    
• Panther AI schema builder

  • Infer schemas from sample logs

There are also AI GraphQL API operations available to Cloud Connected customers and SaaS customers with pass-through billing—view them in the GraphQL API schema.

In addition to Panther AI, Panther offers an MCP server.

Enabling Panther AI

To use Panther AI features, your Panther instance's Enable Panther AI setting must be set to ON and your user role must have the Run Panther AI and Read Settings & SAML Preferences permissions.

To enable Panther AI:

1. In the upper-right corner of your Panther Console, click the gear icon (Settings) > General.

2. On the Panther AI tab, click the Enable Panther AI toggle to ON.

   • The Enable Panther AI setting is set to OFF by default, and can only be updated by a user with the Edit Settings & SAML Preferences permission. See System Configuration to learn more about Panther AI settings.

     
   • Once Enable Panther AI is set to ON, the Run Panther AI permission will be:

     • Granted automatically to the default Admin role.

     • Available to assign to additional roles. Learn how to update a role's permissions here. (A user must additionally have the Read Settings & SAML Preferences permission to use Panther AI.)

       

How Panther AI uses your data

Panther AI does not use your data for AI training. Your prompts and Panther AI responses are stored in your dedicated, single-tenant AWS account (like your logs).

You can enable Panther-managed detections for Amazon Bedrock to monitor its activity. If you are a Cloud Connected customer, you can also set up Amazon Bedrock Guardrails for extra protection.

Learn more in FAQs: Panther AI architecture and security.

AI permissions and scope

Panther AI assumes the role and associated permissions of the user running it—i.e., the user logged into the Console where AI operations are being run, or the user executing AI-related API calls.

This means Panther AI will not perform read or write operations the current user could not perform themselves. This includes log type access restrictions, if set for that user role.

Tool approval for write operations

Panther AI includes a human-in-the-loop approval system for tools that perform write operations. Before Panther AI can execute actions that modify your data, you must explicitly approve or deny the operation. This gives you full control over what changes Panther AI makes in your environment.

Tools requiring approval

The following tools require explicit user approval before execution:

Tool	Description	Required permission
detectionWriterTool	Creates new detection rules	PolicyModify, RuleModify
addAlertCommentTool	Adds comments to alerts	AlertModify
updateAlertTool	Updates alert status, quality assessment, or context tags.	AlertModify
assignAlertTool	Assigns alerts to users	AlertModify
bulkUpdateAlertsTool	Updates multiple alerts at once	AlertModify

How tool approval works

When Panther AI attempts to use a tool that requires approval, Panther AI pauses and displays the proposed action, including the tool name and the parameters it intends to use.

Review the details of the proposed operation, then click Accept or Reject. If you reject the operation, you can optionally provide a reason for denial. If no decision is made within two minutes, the operation times out and is not executed.

Audit logging

All tool approval decisions are recorded in Panther audit logs, including:

• Whether the tool was approved or denied

• The rejection reason (if denied)

• The tool name and parameters

• The user who made the decision

• Timestamp of the decision

This provides a complete audit trail of all write operations performed by Panther AI.

Panther AI settings

Panther AI configurations are made in two places: on the general settings page, and in the AI prompt bar itself.

Panther AI in general settings

The Panther AI tab of the general settings page has settings for enabling Panther AI and auto-running AI alert triage. Learn more about these settings on System Configuration.

AI prompt settings

Use AI prompt settings to tailor AI-generated content in Panther to your preferences. AI settings are universally applied to all AI entry points in Panther, but are specific to each Panther user.

To set your AI prompt settings:

1. Navigate to one of the AI prompt bars in the Panther Console.

2. On the right side of the prompt bar, click the Edit prompt settings icon: .

3. Set the reasoning level setting.

4. Click Save Settings.

Reasoning level

The reasoning level setting controls reasoning depth, model selection, and tool invocation limits—not just output length. The setting determines how thoroughly Panther AI analyzes the input and the sophistication of its analysis approach.

The reasoning level AI setting has three possible values:

• Basic: runs quickly and produces a brief summary

• Standard: recommended for initial alert triage

• Advanced: allows Panther AI to investigate deeply and produce detailed analysis outputs

The reasoning level of auto-run AI triages for alerts triggered by a certain detection can be set by adding a tag to the detection. Learn more in Auto-run AI alert triage.

Suggested and favorite prompts

When opening Panther AI from the left-hand navigation menu, under Suggested questions to get started, you'll see some randomly generated suggested prompts. Click a suggestion to execute it.

You can customize this list by favoriting a prompt:

1. Execute a prompt (in any of the Panther AI entry points).

2. To the right of the prompt text, click the star.

   

   • The prompt will be added to your list of favorite prompts, which appears under Suggested questions to get started, to the left of suggested prompts.

Favorites are specific to you, and are not shared with any other users. To remove a favorite, in the upper-right corner of the prompt tile, click X.

Citations

When Panther AI aids in triaging or summarizing your data, it will return links to relevant data so you can verify its findings. Citations may include alerts, detections, and/or data queries.

Amazon Bedrock service quotas

If you are leveraging Panther AI often (e.g., you are using auto-run AI alert triage), you may hit Amazon Bedrock service quotas. When this happens, Panther AI may not run as expected, or you may see an error in its output.

To remedy this:

• If you are a Cloud Connected customer, follow this Amazon documentation to request an increase for Amazon Bedrock quotas.

• If you are a SaaS customer with pass-through billing, reach out to Support.

Tools

Panther AI has access to many of the same tools available to human users of Panther. When running tools (either in the Console or programmatically), Panther AI has the same permissions set as the current user. In general, Panther AI decides when to use a specific tool based on the task you give it. When entering your own prompt, you can direct it to use certain tools, if desired.

See which tools require human approval before execution above.

Alert management

• addAlertCommentTool: Add comments to alerts

• alertListTool: List recent alerts, with filtering options

• alertTool: Get detailed alert information, including comments and associated events

• assignAlertTool : Assign alerts to users

• bulkUpdateAlertsTool : Update multiple alerts at once

• listAlertContextTags: Lists all available context tags for categorizing alerts.

• updateAlertTool: Update the status of alerts, quality assessment, or context tags.

Data search and analysis

• columnSummaryTool: Analyze distribution of attribute values

• logSearchTool: Find specific log records by attribute/value pairs

• sqlTool: Execute custom SQL queries for complex analysis

• activityHistogram: Get time-bucketed histograms of activity across log sources

Detection management

• detectionListTool: List available detections

• detectionTool: Get detection metadata and code

• detectionWriterTool: Create new detections

• detectionWriterInstructor: Get specific instructions before writing a Panther detection

Log sources, schemas, and metadata

• getSampleDataTool: Retrieves sample log events from a session for schema inference and testing.

• listLogSourcesTool: List onboarded log sources, with health status

• logTypeSchemaTool: Get column details for specific log types

• logTypesTool: List available log types

• testSchemaTool: Validates a Panther schema against sample data, returning match/unmatch statistics and error messages. Must be used iteratively until 100% match rate.

• schemaWriterInstructor: Get instructions about schema structure, field types, and best practices before creating schemas

• classificationErrorFixerInstructor: Get instructions for diagnosing and fixing log classification errors

• logTypeInstructor: Get instructions for analyzing events based on log type

Query (Saved Search) management

• listSavedQueriesTool: List queries (Saved Searches)

• queryResultsTool : Retrieve query results

• savedQueryWriterTool: Created a Saved Search in SQL reuse

Enrichment and context

• enrichmentTool: Look up entity information (IPs, users, etc.)

• userListTool: List Panther users

• userTool: Get details about a user

• calculateRiskScoreTool: Calculate a normalized risk score from benign and risky security indicators

AI responses

• aiResponseTool: Access AI response history

• aiResponseSearchTool: Search the AI response history database for relevant historical context