> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/ai/using-panther-ai/scheduled-ai-prompts.md).

# Scheduled AI Prompts (Beta)

## Overview

{% hint style="info" %}
Scheduled AI prompts are in open beta starting with Panther version 1.120 and are available to all customers. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}

Scheduled AI prompts allow you to automate recurring AI-powered security analyses on a defined schedule. Instead of manually asking Panther AI to triage alerts, summarize security posture, or analyze alert queues, you can configure prompts that run automatically and produce AI conversations with findings.

## Create a scheduled prompt

To create a scheduled prompt:

1. In the left-hand navigation bar of your Panther Console, click **Panther AI** > **Scheduled Prompts.**
2. In the upper-right corner, click the **+** button.
3. Fill out the following fields:
   * **Name**: A descriptive name for your prompt (max 256 characters).
   * **Prompt**: The question or instruction for the AI (max 10,000 characters).
   * **Schedule**: Configure either:
     * **Rate (Periodic)**: Run at fixed time interval (minimum 5 minutes).
     * **Cron Expression**: Run at specific dates and times using [Cron expressions](/search/scheduled-searches.md#how-to-use-the-scheduled-search-crontab) (minimum 5 minutes).
   * **Run As** (Optional): If you have the **AI Run As** permission, you can specify a different user account or API token whose permissions the AI will execute. If left blank, the prompt will run with your permissions.
   * **Enable on creation**: Toggle `ON` for the prompt to run on its configured schedule. Defaults to `ON`.
4. Click **Create** to save your scheduled prompt.

{% hint style="warning" %}
**Scheduled prompt permissions**

Access to scheduled prompts is controlled by two permissions:

* **View Scheduled Prompts** — view prompts, their run history, and download them as YAML. Included in the default `Admin`, `Analyst`, and `AnalystReadOnly` roles (implied by **Run Panther AI**).
* **Manage Scheduled Prompts** — create, edit, delete, enable/disable, and [bulk-import](#manage-scheduled-prompts-as-code) prompts. Included in the default `Admin` role only, and **not** automatically granted to non-`Admin` roles on upgrade. An admin can grant it in **Settings** > **Roles**.

See [RBAC](/system-configuration/rbac.md) for details.

**Run-as identity and data access**

**By default, scheduled prompts run with the creator's permissions.** However, users with the **AI Run As** permission can configure a prompt to run as a specific user or API token instead. The AI uses the same data access, tool permissions, and role restrictions as the configured run-as identity. This means:

* The prompt can only access log types, alerts, and detections that the run-as identity's (or creator's) role permits.
* If the run-as identity's (or creator's) role permissions are later reduced, the prompt's capabilities are reduced accordingly — it will no longer be able to access data or perform actions beyond the updated permissions.
* If the run-as user's (or creator's) account is deleted or disabled, the prompt is automatically disabled and marked as failed.

**Limits**

* There is a limit of 100 enabled scheduled prompts per Panther instance (across all users).
  {% endhint %}

<figure><img src="/files/ZqiSoHPtCC5Arsere56p" alt="" width="563"><figcaption></figcaption></figure>

## View scheduled prompt results

To view the results of a scheduled prompt run:

1. In the left-hand navigation bar of your Panther Console, click **Panther AI** > **Scheduled Prompts**.
2. Click the name of a scheduled prompt to open its detail page.
3. The detail page displays the AI response from the most recent run. Click the **Open in full screen** icon to open the conversation in the Panther AI view.

<figure><img src="/files/X8Z6VOBT3B1GTLte9PkM" alt="The scheduled prompt detail page, showing the Download button and other controls in the header (visible to users with Manage Scheduled Prompts)."><figcaption></figcaption></figure>

The detail page also displays the following run information:

* **Status** — Whether the prompt is currently `ACTIVE` or `DISABLED`.
* **Schedule** — The configured run frequency.
* **Next Run** — The next scheduled execution time (only shown when the prompt is enabled).
* **Last Run** — The scheduled time of the most recent execution and its status: `SUCCEEDED`, `FAILED`, or `RUNNING`.
* **Errors** — If the most recent run failed, a description of the error is displayed below the run status.

If the prompt has not yet executed, the detail page displays the next scheduled run time.

## Manage scheduled prompts

### Edit a scheduled prompt

1. Navigate to **Panther AI** > **Scheduled Prompts**.
2. To open the edit modal, do one of the following:
   * On the prompt card, click the **⋯** menu > **Edit**.
   * On the prompt detail page, click **Edit**.
3. Update the desired fields and click **Update**.

### Enable or disable a scheduled prompt

A disabled prompt is saved but does not run until re-enabled. To enable or disable a prompt:

* On the prompt card, use the toggle switch on the right side of the card.
* On the prompt detail page, use the toggle switch in the page header.

### Delete a scheduled prompt

1. To open the delete confirmation, do one of the following:
   * On the prompt card, click the **⋯** menu > **Delete**.
   * On the prompt detail page, click **Delete**.
2. Confirm the deletion. The prompt is immediately removed from the schedule.

## Manage scheduled prompts as code

You can manage scheduled prompts as YAML files — download them, keep them in version control, edit them, and re-import them — the same way you manage [detections](/panther-developer-workflows/detections-repo.md). This lets you review prompts in pull requests and deploy them through CI/CD.

{% hint style="warning" %}
Bulk upload is **shared-only**: a prompt with `Private: true` is rejected on import. You can download a private prompt for backup, but it will fail to re-import. Importing or downloading prompts requires the [permissions](/system-configuration/rbac.md) described above.
{% endhint %}

{% tabs %}
{% tab title="Console" %}
**Download**

* On a prompt's detail page, click **Download** to export it as a single `.yml` file.
* On the **Scheduled Prompts** list page, click **Download all** to export every prompt as a `.zip` of `.yml` files. Downloads are shared-only by default; if the list contains private prompts, a popup offers an **Include private prompts** toggle (off by default; private prompts are exported for backup only and cannot be re-imported).

**Upload**

Re-import edited prompts through the **Bulk Uploader** in the Console — the same tool used for detections. The uploader identifies each file by its `AnalysisType: scheduled_prompt`, so no special folder layout is required.
{% endtab %}

{% tab title="CLI (PAT)" %}
Use the [Panther Analysis Tool (PAT)](/panther-developer-workflows/detections-repo/pat/managing-scheduled-prompts.md) to validate and upload prompts from a detections repository:

```bash
# Validate without writing
pat validate --path ./scheduled_prompts --api-host "$HOST" --api-token "$TOKEN"

# Upload
pat upload --path ./scheduled_prompts --api-host "$HOST" --api-token "$TOKEN"
```

Uploading scheduled prompts requires [API-token authentication](/panther-developer-workflows/detections-repo/pat/install-configure-and-authenticate-with-pat.md) — AWS-profile authentication is not supported for prompts. See [Managing scheduled prompts with PAT](/panther-developer-workflows/detections-repo/pat/managing-scheduled-prompts.md) for the full workflow and required permissions.
{% endtab %}
{% endtabs %}

<figure><img src="/files/mZDlJ5EWajeMxy1yYBmd" alt="The Scheduled Prompts list page, with the Download all scheduled prompts button in the header."><figcaption></figcaption></figure>

When the loaded list contains a private prompt, **Download all** opens a popup with an **Include private prompts** toggle (off by default). Private prompts are exported for backup only and cannot be re-imported.

<figure><img src="/files/aQq1x7ixkRl4eBzzgBG7" alt="The Download Scheduled Prompts popup, with the Include private prompts toggle off and a backup-only note." width="563"><figcaption></figcaption></figure>

### YAML specification

Each prompt is a single YAML document. Exactly one prompt per file.

```yaml
AnalysisType: scheduled_prompt
PromptName: weekly_iam_review
DisplayName: Weekly IAM Review
Description: Summarize unusual new IAM users created this week.
PromptText: |
  Look at the new IAM users created this week.
  Summarize anything unusual, especially accounts with broad permissions.
OutputLength: medium
Private: false
Enabled: true
RunAsUser: alice@example.com
Schedule:
  CronExpression: "0 9 * * 1"
  TimeoutMinutes: 10
```

<table><thead><tr><th width="200">Field Name</th><th>Description</th><th>Expected Value</th></tr></thead><tbody><tr><td><strong><code>AnalysisType</code></strong></td><td>Identifies the file as a scheduled prompt.</td><td>Must be <code>scheduled_prompt</code>.</td></tr><tr><td><strong><code>PromptName</code></strong></td><td>Unique identifier (the upsert key). Must be unique among live shared prompts.</td><td>Lowercase letters, digits, and underscores, starting with a lowercase letter (<code>^[a-z][a-z0-9_]*$</code>). Max 128 characters.</td></tr><tr><td><strong><code>DisplayName</code></strong></td><td>Human-readable label shown in the Console.</td><td>String, max 256 characters.</td></tr><tr><td><strong><code>PromptText</code></strong></td><td>The instruction sent to Panther AI.</td><td>String, max 10,000 bytes.</td></tr><tr><td><strong><code>RunAsUser</code></strong></td><td>The identity the prompt runs as. The target must hold the <strong>Run Panther AI</strong> permission. Binding to an identity other than the importer requires <strong>AI Run As</strong>.</td><td>A user email address <em>or</em> a Panther API-token ID (begins with <code>po_</code>).</td></tr><tr><td><strong><code>Schedule</code></strong></td><td>When the prompt runs.</td><td>An object containing exactly one of <code>CronExpression</code> or <code>RateMinutes</code> (≥ 5), plus <code>TimeoutMinutes</code> (1–15). See <a href="/pages/-MXJ6kXF1mEem7G5KPSO#how-to-use-the-scheduled-search-crontab">Cron expressions</a>.</td></tr><tr><td><code>Description</code></td><td>Optional description.</td><td>String, max 2,000 characters.</td></tr><tr><td><code>OutputLength</code></td><td>Optional. Controls the length and detail of the response.</td><td>One of <code>small</code> (Basic), <code>medium</code> (Standard), or <code>largest</code> (Advanced).</td></tr><tr><td><code>Private</code></td><td>Optional. Bulk upload is shared-only.</td><td>Must be <code>false</code> or omitted. <code>true</code> is rejected on import.</td></tr><tr><td><code>Enabled</code></td><td>Optional. Whether the prompt runs on its schedule.</td><td>Boolean. Defaults to <code>false</code> when omitted. Downloads always include the explicit current value, so a re-imported prompt preserves its enabled state. If you hand-author a YAML and want it to run, set <code>Enabled: true</code></td></tr></tbody></table>

### Re-importing prompts

The upsert key is `PromptName`, scoped to shared prompts. Re-importing a file updates the existing shared prompt in place and preserves its owner — it does not create a duplicate. To retire a prompt as code, set `Enabled: false` and re-import (there is no delete-via-upload; hard-delete is done in the Console).

A freshly downloaded shared prompt re-imports with no changes. One exception: a prompt that had no explicit run-as identity is updated once on its first re-import, to pin an explicit `RunAsUser`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.panther.com/ai/using-panther-ai/scheduled-ai-prompts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.