Log Forwarder Source (Beta)

Creating a Log Forwarder source in the Panther Console for use with the Panther Log Forwarder agent

Overview

The Log Forwarder source is in open beta starting with Panther version 1.126, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

A Log Forwarder source in Panther makes it easy to send log into Panther using the Panther Log Forwarder (PLF), without needing to configure any additional infrastructure. The PLF source creates the necessary infrastructure in the Panther account (S3 bucket and IAM role) and generates the corresponding PLF yaml configuration that can be placed directly on the host running the PLF agent.

How to set up a Log Forwarder source in Panther

Step 1: Create the source

1. In the left-hand navigation bar of your Panther Console, click Log Sources.

2. In the upper-right corner, click Create New.

3. Select Log Forwarder from the Custom Log Formats section.

4. On the Basic Information page, provide values for the following fields:

   • Name: Enter a descriptive name for the source.

   • Log Types: Select one or more schemas that will be ingested through this forwarder.

5. Click Setup. You will be directed to a success screen.

Step 2: Generate the YAML configuration

After creating the source, you can jump to the generation of the YAML configuration by clicking on the Configure Log Forwarder button in the succss screen. Alternatively, you can go to the Configuration tab and then click on the YAML Configuration tab below to generate a ready-to-use configuration file for the PLF agent.

1. Go to the YAML Configuration tab.

2. Select your input type:

   • File: Enter the path to the log file you want the PLF agent to monitor.

   • Syslog: Choose a protocol (TCP or UDP) and a port number.\

3. Click Generate YAML to generate the ready-to-use configuration.

4. Click the Download button to save the generated YAML file, or the Copy button to copy it to your clipboard.

The generated YAML configuration file contains authentication credentials, so make sure to store it securely.

Step 3: Install the Panther Log Forwarder

The Installation Guide tab under the Configuration page provides a quick guide to download, install, configure, and start the PLF agent. For the full installation instructions and more refined setting, go to Panther Log Forwarder documentation.