Alerts & Destinations
Panther detections trigger alerts on suspicious behavior
Last updated
Was this helpful?
Panther detections trigger alerts on suspicious behavior
Last updated
Was this helpful?
Alerts are generated when your rules, scheduled rules, or policies detect suspicious behavior. When an alert is triggered, it is routed to the appropriate Alert Destination(s) using the . In the Panther Console, you can view an AI-generated summary of your alerts and use AI alert triage to help gather information about an alert and decide what to do next.
Panther can generate three types of alerts:
Alerts: This classification includes rule matches, policy matches, and scheduled rule matches from enabled detections.
Detection errors: These are generated due to incorrect code or permissions issues. When this occurs, a rule returns an error and the rule does not complete its run successfully. This includes .
System errors: Panther's System Errors alert users when a part of the Panther platform is not functioning correctly. This includes log source inactivity, log classification failures, log source permission failures, alert delivery failures, and cloud account scanning failures.
To learn more about these errors, see System Errors.
You can also interact with alerts using the Panther REST API and GraphQL API.
You can customize the content of the alerts you receive for detection matches by using the or .
These functions allow you to, for example, include the matching event (using or ) or add event values to the alert title (using or ).
The alert limiter functionality is intended to safeguard from "alert storms" arising from (likely) misconfigured detections.
If a single detection creates 1,000 alerts within one hour, its CreateAlert field (or Create Alert toggle in the Console) is set to False (or OFF in the Console), which stops the detection from creating additional alerts. (The detection will continue to generate signals on matches.) When this happens, you will receive a System Error notification and alert notifying you of the change.
You can set the CreateAlert/Create Alert value back to True/ON when you are ready—perhaps after some detection tuning.
If you would like to set this alert limit lower than 1,000, please reach out to your Panther Support team.
Any alert information generated dynamically from a detection (by the alert functions in Python detections or dynamic alert keys in Simple Detections) is generated by the output of the first matching event. The output of the alert functions/keys for additional events attached to the alert does not alter the alert.
When deciding how to receive an alert, consider the following options:
Natively supported destinations: Panther supports a number of alert destinations natively, like Slack, Jira, and Amazon SNS. See the Alert Destinations documentation for a complete list of supported destinations.
Custom Webhook: If you'd like to route alerts to a destination that is not natively supported but that has an API, you can use the Custom Webhook option to send alert notifications—see the Custom Webhook documentation for configuration instructions.
Panther API: If you'd like to receive Panther alerts at a destination that is not natively supported and that does not have an API, you can receive alerts by polling the Panther API for alerts on a schedule. See the available API operations for fetching and manipulating alerts on Alerts (REST) and Alerts & Errors (GraphQL).
When you receive an alert to your configured destination, it’s time to investigate. Common investigation workflows include:
Using AI alert triage.
Using Search to investigate indicators of compromise (IoCs).
Using Data Explorer to search robustly using SQL.
Reviewing data from the Panther Console overview dashboard.
See the Investigations & Search documentation for more information on Panther’s data analysis tools.
For more information on triaging, assigning, and managing alerts, see the following documentation pages:
Triage, use alert summaries, assign, un-assign, view alert history, and add comments to alerts.
You can also manage alerts in Slack when using the Slack Bot alert destination.
For many Panther-managed detections, find recommended steps to remediate the issue that triggered the alert.
Log in to your Panther Console.
The landing page is the overview dashboard, where you can view alert metrics and a list of the alerts assigned to you. Continue on to the next steps to view a list of all alerts.
In the left-hand navigation bar, click Alerts.
By default, this page lists alerts from most recent to oldest and displays only Open and Triaged alerts.
Near the top of this page, you can view the AI-generated alerts list summary.
While viewing the list of alerts as described above, click an alert title to view the alert details page:
The alert details page includes:
Basic information
This includes the detection that triggered the alert, the associated log types, the assignee, the alert status, the MITRE tactic, and the alert runbook.
A Start Panther AI Triage option
See AI alert triage.
A list of event matches
For each event, you can view event time, event source, the associated p_log_type and p_source_label, and IP information.
External conversations
Alert history
This includes a history of all status changes and comments.
If the alert failed to deliver to one of the configured alert destinations, you will see an "Alert delivery failed" error above the history.
The Summary tab on the alert details page is described in Assigning and Managing Alerts.
While viewing alerts in your Panther Console, you can view an AI-generated summary of the alerts on your alert list page, as well as use AI alert triage to accelerate information gathering and analysis on an alert.
Learn more about Panther AI, including how to configure AI response length, on Panther AI.
As you are viewing the alerts list in the Panther Console, you will see an ALERT SUMMARY FOR FIRST N ALERTS section near the top of the page.
By default, the summary includes the first 25 alerts—those alerts initially loaded on the page. As you scroll down and load more alerts into view, the AI summary will regenerate.
The summary is likely to describe the events represented in the alerts, and may include the risk level posed, relevant MITRE ATT&CK tactics, suggested follow-up actions, and more.
In the prompt box below the ALERT SUMMARY FOR FIRST N ALERTS header, you can ask questions about the data or refine the prompt.
Panther AI alert triage performs an investigation and analysis on an alert. It can help you gather more information about an alert and decide what to do next.
Unless otherwise directed by you, Panther AI will only perform read operations during its triage of an alert. You may direct Panther AI to perform write operations by clicking an action button in the alert triage output (e.g., Close alert and mark as Resolved) or by entering a directive in the prompt bar.
To use Panther AI triage:
On an alert detail page, click Start Panther AI Triage.
If you have already run AI alert triage for this alert, click View Panther AI Triage.
A slide-out panel will appear, where Panther AI will output its findings:
(Optional) In the prompt box at the top of the slide-out panel, ask follow-up questions or direct Panther AI to take some action on the alert. These prompts and their responses are preserved in the AI response history. For example:
Did this user take any other action in AWS an hour before or after this event?
Add triage summary as alert comment (will not close alert):
Creates a comment containing a high-level alert summary in the alert's Activity log.
(If the alert's status is Open or Triaged) Close alert, comment and mark as Resolved:
Updates the alert status to Resolved. This is recorded in the alert's Activity log.
Creates a comment containing a high-level alert summary in the alert's Activity log.
If the Assign alert to me upon closing toggle is set to ON, the alert assignee will be set as you. This is recorded in the alert's Activity log.
(If the alert's status is Open or Triaged) Close alert, comment and mark as Invalid:
Updates the alert status to Invalid. This is recorded in the alert's Activity log.
Creates a comment containing a high-level alert summary in the alert's Activity log.
Each generated alert in Panther is enriched with the following timestamps:
p_alert_creation_time
The first time an event matched this rule
p_event_time
The time the event reported itself as happening
p_parse_time
The time the event was processed by Panther
p_alert_update_time
The last time an event matched this rule (in the case of deduplication)
If a detection has set a , all events matching the detection that share the same deduplication string will be appended to the first alert created, for the length of the deduplication period. This can result in an alert with more than one event associated to it.
For example, if a detection uses to dynamically set the alert severity based on an event property and the first matching event dictates a LOW severity, the alert severity will be set to LOW indefinitely—even if an event later associated to the alert, run through the same severity() function, would dictate a HIGH severity.
To receive alerts outside of the Panther Console, set up an alert destination and ensure it's configured to receive alerts based on the .
directly from alerts.
Filter the list as needed to narrow your results.
Click the tabs at the top of the list to filter by the alert type: Alerts, Detection Errors, or System Errors.
If there is additional context in a , Jira ticket, or Asana task where an alert was delivered, you can click the links in this section to view that information.
You can also in this section.
Use of Panther AI features is subject to the .
AI alert triage may provide a summary of the alert, judgement on whether the alert is a false or true positive, recommended follow-up actions, and an indication of its confidence level. The Panther AI analysis of certain alerts may include a diagram visualizing Panther AI's "thought process" and/or the events that led to the alert. The analysis will include to Panther entities (such as alerts, detections, and searches) when appropriate.
It's recommended to provide a descriptive on your detection, as Panther AI alert triage will take it into consideration.
Learn more about Panther AI, including how to and manage AI responses, on Panther AI and Managing Panther AI Response History.
Update this alert's status to "Invalid" and leave a comment saying "False positive."
(Optional) Under Next Steps, click one of the action buttons:
If the Assign alert to me upon closing toggle is set to ON, the alert assignee will be set as you. This is recorded in the alert's Activity log.
