Realm Onboarding Guide

Overview

Realm is a security data pipeline tool that collects, transforms, and routes log data to downstream destinations. You can configure Realm to forward logs to Panther using an HTTP source, where Panther ingests, parses, and makes the data available for detection and investigation.

How to set up a Realm integration

Prerequisites

• A Panther account with permissions to create log sources.

• A Realm account with permissions to create destinations and output feeds.

Step 1: Create an HTTP source in Panther

Follow Panther's instructions for configuring an HTTP Source.

• For the Auth method, select Bearer.

• Payloads sent to this source are subject to the payload requirements for all HTTP sources.

• Do not proceed to the next step until the creation of your HTTP endpoint has completed.

Step 2: Configure the Panther destination in Realm

1. In Realm, navigate to the Destinations page.

2. Create a new destination for Panther.

3. Add a new Output Feed and configure the following fields:

   • Name: Panther

   • Method: HTTP

   • Endpoint: Your Panther HTTP Source URL, copied in Step 1.

   • Bearer Token: The Bearer Token you created in Step 1.

   • Compression: GZIP or ZSTD.

4. Save the Output Feed. Realm begins forwarding log data to your Panther HTTP source.