> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/data-onboarding/supported-logs/cursor.md). # Cursor Logs (Beta) ## Overview {% hint style="info" %} Cursor Audit log ingestion is in open beta starting with Panther version 1.126, and is available to all customers. Please share any bug reports and feature requests with your Panther support team. {% endhint %} Panther supports ingesting [Cursor](https://cursor.com/docs) logs by configuring a Cursor webhook to post events to an HTTP endpoint in Panther. ## How to onboard Cursor logs to Panther ### Prerequisites * An active Cursor Enterprise subscription with administrative access ### Step 1: Create a new Cursor source in Panther 1. In the left-side navigation bar of your Panther Console, click **Configure** > **Log Sources.** 2. Click **Create New**. 3. Search for “Cursor” then click its tile. 4. In the upper-right corner, click **Start Setup**. 5. Follow Panther's [instructions for configuring an HTTP Source](/data-onboarding/data-transports/http.md#how-to-set-up-an-http-log-source-in-panther), beginning at Step 5. * When setting the **Auth method**, you will be required to use **Bearer**. * Payloads sent to this source are subject to the [payload requirements for all HTTP sources](/data-onboarding/data-transports/http.md#payload-requirements). * Do not proceed to the next step until the creation of your HTTP endpoint has completed. ### Step 2: Enable Streaming Audit Logs in Cursor Once your Panther HTTP endpoint is ready, contact the Cursor support team at from an administrative email address and request activation of streaming audit logs for your account. Include the following information in your request: 1. Your Enterprise team information (team name or admin contact) 2. Your Panther HTTP webhook URL (from Step 1) 3. Your Bearer token value used in Panther configuration (you can use whichever secure method your team prefers, for example, a password manager share link or an encrypted file). Once Cursor support confirms that streaming has been enabled, return to your Panther Console and verify that audit log events are being received successfully. ## Supported log types ### Cursor.Audit Audit logs provide a record of security events and administrative actions that can help you meet compliance requirements and investigate security incidents. For more information, see the [Cursor Compliance and Monitoring](https://cursor.com/docs/enterprise/compliance-and-monitoring) page. ```yaml schema: Cursor.Audit description: Audit logs provide a record of security events and administrative actions which help you meet compliance requirements and investigate security incidents. referenceURL: https://cursor.com/docs/enterprise/compliance-and-monitoring fields: - name: add_user description: Details about a user being added to the team type: object fields: - name: source description: How the user was added (e.g. autoEnroll, sso) type: string - name: team_id description: Team ID the user was added to type: string - name: user_email description: Email of the user being added type: string indicators: - email - name: invited_by_user_id description: User ID of the person who invited type: string - name: role description: Role assigned to the new user type: string - name: api_key description: Details about a service account API key action type: object fields: - name: action description: Action performed on the API key (e.g. create) type: string - name: api_key_id description: Unique identifier of the API key type: string - name: repo_scope_enabled description: Whether repository scope is enabled for the key type: boolean - name: service_account_id description: ID of the service account the key belongs to type: string - name: service_account_name description: Name of the service account the key belongs to type: string - name: bugbot_team_settings description: Bugbot team settings changes type: object fields: - name: new_value description: New Bugbot team settings value type: string - name: setting_name description: Setting name type: string - name: invite_email_sent description: Details about an invite email being sent type: object fields: - name: invite_id description: Unique identifier of the invite type: string - name: personal_message description: Whether a personal message was included type: string - name: recipient_email description: Email address of the invite recipient type: string indicators: - email - name: role description: Role granted by the invite type: string - name: sender_email description: Email address of the invite sender type: string indicators: - email - name: sender_user_id description: User ID of the invite sender type: string - name: invite_link description: Details about an invite link action type: object fields: - name: action description: Action performed on the invite link (e.g. create) type: string - name: creator_email description: Email of the invite link creator type: string indicators: - email - name: creator_user_id description: User ID of the invite link creator type: string - name: expires_in_seconds description: Expiry duration of the invite link in seconds type: bigint - name: invite_id description: Unique identifier for the invite link type: string - name: role description: Role granted by the invite link type: string - name: ip_address description: IP address of the actor type: string indicators: - ip - name: login description: Details about a login event type: object fields: - name: login_type description: Type of login (e.g. LOGIN_TYPE_WEB) type: string - name: success description: Whether the login was successful type: boolean - name: mcp_server_config description: Details about an MCP server configuration change type: object fields: - name: action description: Action performed on the MCP server (e.g. create, delete) type: string - name: scope description: Scope of the MCP server config (e.g. user, team) type: string - name: server_name description: Name of the MCP server type: string - name: server_type description: Type of MCP server (e.g. HTTP) type: string - name: metadata description: Request and context metadata type: object fields: - name: id description: Unique event ID type: string indicators: - trace_id - name: timestamp required: true description: Timestamp of the event type: timestamp timeFormats: - rfc3339 isEventTime: true - name: context description: Request context type: object fields: - name: auth_id description: Authenticated user ID type: string indicators: - actor_id - name: ghost_mode description: Whether ghost mode was active type: boolean - name: privacy_mode description: Privacy mode setting type: string - name: request_id description: Unique request ID type: string indicators: - trace_id - name: remove_user description: Details about a user being removed from the team type: object fields: - name: user_email description: Email of the user being removed type: string indicators: - email - name: service_account description: Details about a service account action type: object fields: - name: action description: Action performed on the service account (e.g. create, archive) type: string - name: service_account_id description: Unique identifier of the service account type: string - name: service_account_name description: Name of the service account type: string - name: team_api_key description: Details about a team API key action type: object fields: - name: action description: Action performed on the API key (e.g. revoke) type: string - name: team_command description: Details about a team command action type: object fields: - name: action description: Action performed on the command (e.g. create, delete) type: string - name: command_id description: Unique identifier of the command type: string - name: command_name description: Name of the command type: string - name: is_active description: Whether the command is active type: boolean - name: team_hook description: Details about a team hook action type: object fields: - name: action description: Action performed on the hook (e.g. create, delete) type: string - name: hook_id description: Unique identifier of the hook type: string - name: hook_step description: Step at which the hook executes (e.g. beforeShellExecution) type: string - name: hook_type description: Type of hook (e.g. command) type: string - name: is_active description: Whether the hook is active type: boolean - name: operating_systems description: Operating systems the hook applies to type: array element: type: string - name: script_content description: Content of the hook script type: string - name: script_name description: Name of the hook script type: string - name: team_id description: Unique identifier of the team type: string - name: team_marketplace description: Details about a team marketplace action type: object fields: - name: action description: Action performed on the marketplace (e.g. create) type: string - name: marketplace_id description: Unique identifier of the marketplace type: string - name: marketplace_name description: Internal name of the marketplace type: string - name: marketplace_display_name description: Display name of the marketplace type: string - name: new_auto_reindex description: New auto-reindex setting type: boolean - name: old_auto_reindex description: Previous auto-reindex setting type: boolean - name: plugin_id description: ID of the plugin involved type: string - name: plugins_created description: Number of plugins created type: int - name: plugins_deprecated description: Number of plugins deprecated type: int - name: plugins_indexed description: Number of plugins indexed type: int - name: plugins_updated description: Number of plugins updated type: int - name: team_id description: Team ID associated with the marketplace type: string - name: team_rule description: Details about a team rule action type: object fields: - name: action description: Action performed on the rule (e.g. create, delete) type: string - name: is_active description: Whether the rule is active type: boolean - name: is_required description: Whether the rule is required type: boolean - name: rule_id description: Unique identifier of the rule type: string - name: rule_name description: Name of the rule type: string - name: team_settings description: Details about a team settings change type: object fields: - name: setting_name description: Name of the setting changed type: string - name: old_value description: Previous value of the setting type: string - name: new_value description: New value of the setting type: string - name: update_user_role description: Details about a user role update type: object fields: - name: user_email description: Email of the user whose role was updated type: string indicators: - email - name: old_role description: Previous role of the user type: string - name: new_role description: New role assigned to the user type: string - name: user_api_key description: Details about a user-level API key action type: object fields: - name: action description: Action performed on the user API key (e.g. create, revoke) type: string - name: user_email description: Email of the user performing the action type: string indicators: - email - name: user_spend_limit description: Details about a user spend limit change type: object fields: - name: new_limit_cents description: New spend limit in cents type: bigint - name: old_limit_cents description: Previous spend limit in cents type: bigint - name: target_user_email description: Email of the user whose spend limit was changed type: string indicators: - email ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.panther.com/data-onboarding/supported-logs/cursor.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.