Knowledge BaseCommunityRelease NotesTraining VideosRequest Demo
Search
⌃K
Links

Amazon SNS Destination

Configuring Amazon SNS as an alert destination in your Panther Console

Overview

Destinations are integrations that receive alerts from rules, policies, system health notifications, and rule errors. Panther supports configuring Amazon Simple Notification Service (SNS) as the destination where you will receive alerts.

How to set up Amazon SNS alert destinations in Panther

SNS Prerequisites

The SNS Destination requires a Topic ARN. When an alert is forwarded to an SNS Destination, it publishes a JSON string to that topic.
  1. 1.
    In the AWS SNS console, create a new Topic or navigate to the topic you wish to add as a destination. We will be editing its permissions so Panther can publish messages to it:
    The image shows the AWS SNS Console's "Topics" page, which lists your topics. In the list there is a topic named "ExampleTopic."
    ​
  2. 2.
    After selecting the SNS topic, click Edit then scroll down and expand the "Access policy" section:
    The image shows the AWS SNS Console with the editor open for the topic called "ExampleTopic." There are sections for Details, Encryption, and Access policy. The Access policy section is expanded and displays a JSON text editor.
    ​
  3. 3.
    After expanding the "Access policy" section, add the following statement to the Statement block. Be sure to replace the Principal field with the AWS account ID where Panther is deployed and the Resource field with the ARN of your own SNS Topic and the ID of the AWS account it resides in.
    {
    "Sid": "AllowPantherAlarming",
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::<YOUR-PANTHER-AWS-ACCOUNT-ID>:root"
    },
    "Action": "sns:Publish",
    "Resource": "<SNS-DESTINATION-ARN>:<SNS-AWS-ACCOUNT-ID>:<YOUR-TOPIC-NAME>"
    }
    • To find your Panther AWS account ID, go to Settings > General in the Panther Console. It is located in the footer:
      The image shows the footer of the Panther Console. The footer contains the AWS Account ID, version, AWS region, and Gateway Public IP.
      ​

Configure the Destination in Panther

  1. 1.
    Log in to the Panther Console and navigate to Configure > Alert Destinations.
  2. 2.
    Click +Add your first Destination.
    • If you have already created Destinations, click Create New in the upper right side of the page to add a new Destination.
  3. 3.
    Click AWS SNS in the list of options.
  4. 4.
    Fill out the form to configure the Destination:
    • Display Name: Enter a descriptive name.
    • Topic ARN: Enter the value of the Topic ARN from the SNS Prerequisites section.
    • Severity: Select the severity level of alerts to send to this Destination.
    • Alert Types: Select the alert types to send to this Destination.
    • Log Type: By default, we will send alerts from all log types. Specify log types here if you want to only send alerts from specific log types.
      The image shows the "Configure your SNS Destination" page in the Panther Console. It contains fields for Display Name, Topic ARN, Severity, Alert Types, and Log Types.
      ​
  5. 5.
    Click Add Destination.
  6. 6.
    On the next screen, click Finish Setup to complete your setup, or click Send Test Alert to test your setup.
    • Your SNS Topic will now be able to receive Panther alerts. If your goal is to set up email notifications with this topic, continue below.

Optional: Creating Email Notifications

  1. 1.
    In the AWS SNS console, click Create Subscription on the topic you just created. The topic ARN should match the topic you created.
    The image shows the AWS SNS Console's page for creating a subscription. The Details section is expanded to show fields for Topic ARN, Protocol, and Endpoint. There is a "Create Subscription" button at the bottom.
    ​
  2. 2.
    Select Email in the protocol dropdown menu and enter the email address you would like to receive alerts to.
  3. 3.
    Click Create subscription
  4. 4.
    Confirm the subscription sent to your email before receiving alerts from this topic.\

Additional Information on Destinations

For more information on alert routing order, modifying or deleting destinations, and workflow automation, please see the Panther docs: Destinations.
Previous
Alert Destinations
Next
Amazon SQS Destination
Last modified 9mo ago