Amazon SNS Destination

Configuring Amazon SNS as an alert destination in your Panther Console


Destinations are integrations that receive alerts from rules, policies, system health notifications, and rule errors. Panther supports configuring Amazon Simple Notification Service (SNS) as the destination where you will receive alerts.

How to set up Amazon SNS alert destinations in Panther

SNS Prerequisites

The SNS Destination requires a Topic ARN. When an alert is forwarded to an SNS Destination, it publishes a JSON string to that topic.

  1. After expanding the "Access policy" section, add the following statement to the Statement block. Be sure to replace the Principal field with the AWS account ID where Panther is deployed and the Resource field with the ARN of your own SNS Topic and the ID of the AWS account it resides in.

          "Sid": "AllowPantherAlarming",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::<YOUR-PANTHER-AWS-ACCOUNT-ID>:root"
          "Action": "sns:Publish",

Configure the Destination in Panther

  1. Log in to the Panther Console and navigate to Configure > Alert Destinations.

  2. Click +Add your first Destination.

    • If you have already created Destinations, click Create New in the upper right side of the page to add a new Destination.

  3. Click AWS SNS in the list of options.

  4. Fill out the form to configure the Destination:

    • Display Name: Enter a descriptive name.

    • Topic ARN: Enter the value of the Topic ARN from the SNS Prerequisites section.

    • Severity: Select the severity level of alerts to send to this Destination.

    • Alert Types: Select the alert types to send to this Destination.

  5. Click Add Destination.

  6. On the next screen, click Finish Setup to complete your setup, or click Send Test Alert to test your setup.

    • Your SNS Topic will now be able to receive Panther alerts. If your goal is to set up email notifications with this topic, continue below.

Optional: Creating Email Notifications

  1. Select Email in the protocol dropdown menu and enter the email address you would like to receive alerts to.

  2. Click Create subscription

  3. Confirm the subscription sent to your email before receiving alerts from this topic.\

Additional Information on Destinations

For more information on alert routing order, modifying or deleting destinations, and workflow automation, please see the Panther docs: Destinations.

Last updated