Saved and Scheduled Searches

Overview

You can avoid repeatedly creating the same searches in Panther's Data Explorer and Search by saving your searches. You can also schedule searches created in Data Explorer, which allows you to then run results against a rule. This workflow includes the following features:

• Create a Saved Search, a preserved search expression.

• Create a Scheduled Search, a Saved Search that you can schedule to run on a designated interval.

• Create a Scheduled Rule, a detection that's associated with a Scheduled Search. The data returned each time the search executes is run against the detection, alerting when matches are found.

By default, each Panther account is limited to 10 active Scheduled Searches. This limit is only precautionary, and can be increased via a support request. There is no additional cost from Panther for raising this limit, however you may incur extra charges from the database backend, depending on the volume of data processed.

How to create a Saved Search

A Saved Search is a preserved search expression. Saving the searches your team runs frequently can help reduce duplicated work. You can create Saved Searches in the Panther Console (in either Search or Data Explorer), using the CLI workflow (PAT), or with the Panther API.

You can also add variables in your Saved Searches, creating Templated Queries. Learn more on Templated Queries and Macros.

AnalysisType: saved_query
QueryName: MySavedQuery
Description: Example of a saved query for PAT
Query: |-
    Your query goes here
Tags:
  - Your tags

How to create a Scheduled Search

A Scheduled Search is a Saved Search that has been configured to run on a schedule. Using the Panther Console, currently only Saved Searches created in Data Explorer can be scheduled—Saved Searches created in Search (including those created in both SQL and PantherFlow) cannot be scheduled. You can alternatively create and upload Scheduled Searches using the CLI workflow or the Panther API.

Note that creating a Scheduled Search alone won't run the returned data against detections or generate signals. To do this, you must also create a Scheduled Rule, and associate it with your Scheduled Search.

AnalysisType: scheduled_query
QueryName: ScheduledQuery_Example
Description: Example of a scheduled query for PAT
Enabled: true
Query: |-
    Select 1
Tags:
  - Your tags   
Schedule:
  CronExpression: "0 0 29 2 *"
  RateMinutes: 0
  TimeoutMinutes: 2

How to use the Scheduled Search crontab

Panther's Scheduled Search crontab uses the standard crontab notation consisting of five fields: minutes, hours, day of month, month, day of week. Additionally, you will find a search timeout selector (with a maximum value currently set at 10 minutes). The expression will run on UTC.

The interpreter uses a subset of the standard crontab notation:

┌───────── minute (0 - 59)
│ ┌──────── hour (0 - 23)
│ │ ┌────── day of month (1 - 31)
│ │ │ ┌──── month (1 - 12)
│ │ │ │ ┌── day of week (0 - 6 => Sunday - Saturday)
│ │ │ │ │               
↓ ↓ ↓ ↓ ↓
* * * * *

If you want to specify day by day, you can separate days with dashes (1-5 is Monday through Friday) or commas, for example 0,1,4 in the Day of Week field will execute the command only on Sundays, Mondays and Thursdays. Currently, we do not support using named days of the week or month names.

Using the crontab allows you to be more specific in your schedule than the Period frequency option:

How to configure a Scheduled Search to generate an email report

You can configure a Scheduled Search to send an email report each time it runs. The email report contains a download link for the results (if there are more than zero), a link to the search in Data Explorer, and optionally a CSV attachment containing the search results. If the Scheduled Search is associated to any Scheduled Rules, those Scheduled Rules will process returned data as usual.

The following parameters for email reports apply:

• Each email report can be sent to a maximum of 10 recipients.

• The maximum size of the CSV attachment is 10 MB. If your query results are large enough that the CSV exceeds this size, the CSV will not be attached to the email.

• You can send up to 20 email reports per day, across all Scheduled Searches in your Panther instance.

  • The number of email reports sent per day depends on how often your Scheduled Searches run.

  • For example, if you have one Scheduled Search that sends 15 email reports per day, and another that sends five email reports per day, you will be unable to configure an additional Scheduled Search to generate email reports unless you reduce the frequency of the existing configurations.

Only Scheduled Searches can be configured for email reporting—because searches made in Search with PantherFlow or filter expressions can be saved but not scheduled, they cannot be configured to generate email reports.

AnalysisType: scheduled_query
QueryName: ScheduledQuery_Example
Description: Example of an email report for PAT
Enabled: true
Schedule:
  RateMinutes: 900
  TimeoutMinutes: 2
EmailConfig:
  Recipients:
    - [email protected]
    - [email protected]
  SendEmpty: true
  PreferAttachment: true

Using Saved and Scheduled Searches

How to delete or download a Saved Search

You can delete Saved Searches individually or in bulk. Note that if a Saved Search is scheduled (i.e., it's a Scheduled Search), it must be unlinked from any Scheduled Rules it's associated to in order to be deleted.

1. In the left-hand navigation bar of your Panther Console, click Investigate > Saved Searches.

2. In the list of Saved Searches, find the search or searches you'd like to download or delete. Check the box to the left of the name of each search.

3. At the top of the page, click either Download or Delete.

   • If you clicked Download, a saved_queries.zip file will be downloaded.

   • If you clicked Delete, an Attention! modal will pop up. Click Confirm.

How to deactivate a Scheduled Search

1. In the left-hand navigation bar of your Panther Console, click Investigate > Saved Searches.

2. Find the Scheduled Search you'd like to deactivate, and in the upper right corner of its tile, click the three dots icon.

3. In the dropdown menu, click Edit Search Metadata.

4. In the Update Search form, toggle the setting Is it active? to OFF to disable the query.

5. Click Update Query to save your changes.

Update a Saved Search's metadata

To edit a Saved Search's name, tags, description, and default database (and, for Scheduled Searches, whether it's active, its frequency, and its email report settings):

1. In the left-hand navigation bar of your Panther Console, click Investigate > Saved Searches.

2. Locate the query you'd like to edit, and click the three dots icon in the upper right corner of its tile.

3. In the dropdown menu, click Edit Search Metadata.

4. Make changes in the Update Search form as needed.

5. Click Update Search.

Search for Saved Searches

On the Saved Searches page, you can search for queries using:

• The search bar at the top of the queries list

• The date range selector in the upper right corner

• The Filters option in the upper right corner

  • Filter by whether the query is scheduled, whether its active, its type (Native SQL, Search, or PantherFlow Search), or by up to 100 tags.

Click on the name of the Saved Search to be taken directly to Data Explorer (for Native SQL queries) or Search (for Search and PantherFlow Search searches) with the query populated.

Use LIMITs in Scheduled Searches

In the Panther Data Lake settings page, you can optionally enable a setting that will check if a Scheduled Search has a LIMIT clause specified. Use this option if you're concerned about a Scheduled Search unintentionally returning thousands of results, potentially resulting in alert delays, Denial of Service (DoS) for downstream systems and general cleanup overhead from poorly tuned queries.

1. In the upper right corner of the Panther Console, click the gear icon. In the dropdown menu that appears, click General.

2. Click the Data Lake tab.

3. Scroll down to the Scheduled Queries header. Below the header, you will see the LIMIT clause toggle setting:

4. Toggle the LIMIT Clause for Scheduled Queries setting to ON to start enforcing LIMITs in Scheduled Queries.

When this field is set to ON, any new Scheduled Searches marked as active cannot be saved unless a LIMIT clause is specified in the query definition.

Existing Scheduled Searches without a LIMIT clause will appear with a warning message in the list of Saved Searches, and edits cannot be saved unless a LIMIT clause is included.

The setting only checks for the existence of a LIMIT clause anywhere in the Saved Search. It does not check specifically for outer LIMIT clauses.

Exporting Scheduled Searches from your Panther Console

You can export a .zip file of all of the detections and Scheduled Searches in your Panther Console:

1. In the left-hand navigation bar of your Panther Console, click Detections.

2. In the upper-right corner, click Upload.

3. In the Bulk Uploader modal, click Download all entities.

Saved Search specification reference

Required fields are in bold.

A complete list of Saved Search specification fields:

Scheduled Search specification reference

Required fields are in bold.

A complete list of Scheduled Search specification fields:

CronExpression: "0 0 29 2 *"
  RateMinutes: 0
  TimeoutMinutes: 2

EmailConfig:
  Recipients:
    - [email protected]
    - [email protected]
  PreferAttachment: true
  SendEmpty: false