Data Transports
Panther integrates with various common data transport log ingestion sources
Last updated
Was this helpful?
Panther integrates with various common data transport log ingestion sources
Last updated
Was this helpful?
A Data Transport is a type of log source that sends log types that are not natively supported by Panther—i.e., . Using Data Transports, you can process custom data types through Panther’s log processing pipeline, map existing detections to custom data types, and map data models to custom data types.
In addition to using a Data Transport to onboard your custom logs, you'll need to create a to normalize and classify the data.
Learn about to Panther, as well as , below.
Panther currently supports the following Data Transport methods:
Panther will transparently decompress compressed data, meaning no extra headers are required. Panther's decompression works by first determining the compression algorithm each file was compressed with. This is not inferred from the file extension or metadata, but rather the content of the file itself.
Panther supports the following compression formats:
Panther only supports zstd data that was compressed without the use of a dictionary.
The inner data of Parquet files can be compressed with the following algorithms:
gzip
snappy
The inner data of the OCF files can be compressed with any of the following algorithms:
gzip
snappy
zst
When forwarding data to Panther using a Data Transport source, you can expect data to be ingested within five minutes. After ingestion, it can then take up to two and a half minutes for an alert to be generated (when applicable).
These time frames are applicable to all Data Transport sources; there is not a particular source that has a shorter latency than the others.
The following Data Transport mechanisms support ingesting compressed data (according to one of the ):
The inner data of a compressed payload must match the you've configured for your Data Transport source.
Panther can transparently detect and ingest files with a maximum size of 100MB (compressed).
Panther can transparently detect and ingest Object Container Files(OCF).
Visit the Panther Knowledge Base to that answer frequently asked questions and help you resolve common errors and issues.