Scheduled AI Prompts (Beta)

Overview

Scheduled AI prompts are in open beta starting with Panther version 1.120 and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Scheduled AI prompts allow you to automate recurring AI-powered security analyses on a defined schedule. Instead of manually asking Panther AI to triage alerts, summarize security posture, or analyze alert queues, you can configure prompts that run automatically and produce AI conversations with findings.

Create a scheduled prompt

To create a scheduled prompt:

1. In the left-hand navigation bar of your Panther Console, click Panther AI > Scheduled Prompts.

2. In the upper-right corner, click the + button.

3. Fill out the following fields:

   • Name: A descriptive name for your prompt (max 256 characters).

   • Prompt: The question or instruction for the AI (max 10,000 characters).

   • Schedule: Configure either:

     • Rate (Periodic): Run at fixed time interval (minimum 5 minutes).

     • Cron Expression: Run at specific dates and times using Cron expressions (minimum 5 minutes).

   • Run As (Optional): If you have the AI Run As permission, you can specify a different user account or API token whose permissions the AI will execute. If left blank, the prompt will run with your permissions.

   • Enable on creation: Toggle ON for the prompt to run on its configured schedule. Defaults to ON.

4. Click Create to save your scheduled prompt.

Scheduled prompt permissions

By default, scheduled prompts run with the creator's permissions. However, administrators with the AI Run As permission can configure a prompt to run as a specific user or API token instead. The AI uses the same data access, tool permissions, and role restrictions as the configured run-as user. This means:

• The prompt can only access log types, alerts, and detections that the run-as user's (or creator's) role permits.

• If the run-as user's (or creator's) role permissions are later reduced, the prompt's capabilities are reduced accordingly — it will no longer be able to access data or perform actions beyond the updated permissions.

• If the run-as user's (or creator's) account is deleted or disabled, the prompt is automatically disabled and marked as failed.

• There is a limit of 100 scheduled prompts per user.

View scheduled prompt results

To view the results of a scheduled prompt run:

1. In the left-hand navigation bar of your Panther Console, click Panther AI > Scheduled Prompts.

2. Click the name of a scheduled prompt to open its detail page.

3. The detail page displays the AI response from the most recent run. Click the Open in full screen icon to open the conversation in the Panther AI view.

The detail page also displays the following run information:

• Status — Whether the prompt is currently ACTIVE or DISABLED.

• Schedule — The configured run frequency.

• Next Run — The next scheduled execution time (only shown when the prompt is enabled).

• Last Run — The scheduled time of the most recent execution and its status: SUCCEEDED, FAILED, or RUNNING.

• Errors — If the most recent run failed, a description of the error is displayed below the run status.

If the prompt has not yet executed, the detail page displays the next scheduled run time.

Manage scheduled prompts

Edit a scheduled prompt

1. Navigate to Panther AI > Scheduled Prompts.

2. To open the edit modal, do one of the following:

   • On the prompt card, click the ⋯ menu > Edit.

   • On the prompt detail page, click Edit.

3. Update the desired fields and click Update.

Enable or disable a scheduled prompt

A disabled prompt is saved but does not run until re-enabled. To enable or disable a prompt:

• On the prompt card, use the toggle switch on the right side of the card.

• On the prompt detail page, use the toggle switch in the page header.

Delete a scheduled prompt

1. To open the delete confirmation, do one of the following:

   • On the prompt card, click the ⋯ menu > Delete.

   • On the prompt detail page, click Delete.

2. Confirm the deletion. The prompt is immediately removed from the schedule.