Ctrlk
Knowledge BaseRelease NotesRequest Demo
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Material Security Logs

Connecting Material Security logs in your Panther Console

Overview

Panther ingests Material Security logs by configuring an Event Subscription in Material to forward events to an HTTP endpoint in Panther.

Material Security is a unified email security, user behavior analytics, and data loss prevention solution for Microsoft 365 and Google Workspace.

How to onboard Material Security logs to Panther

Step 1: Create a new Material Security source in Panther

To connect these logs into Panther:

  1. In the left-hand navigation bar of your Panther Console, click Log Sources.

  2. Click Create New.

  3. Search for “Material Security,” then click its tile.

  4. Click Start Setup.

  5. Follow Panther's instructions for configuring an HTTP Source, beginning at Step 5.

    • In the Auth method dropdown field, select Bearer.

    • Payloads sent to this source are subject to the payload requirements for all HTTP sources.

    • Do not proceed to the next step until the creation of your HTTP endpoint has completed.

Step 2: Create an Event Subscription in Material Security

  1. Log into your Material Security tenant.

  2. In the top tool bar, click Integrations.

  3. Scroll down to SIEM, then click Panther.

  4. Enter values for the following fields:

    • Method: Set to POST

    • URI: Your Panther HTTP source

    • Headers: Add the bearer token you entered or generated in Panther in Step 1

      • For example: { "Authorization": "Bearer <token value>" }

  5. Events: Issue Change and Audit Log Updated are pre-configured by default.

    • By default, the webhook triggers any issue change occurs or the audit log updates.

    • Optionally, click the Issue Change event row to edit.

      • Consider filtering Issue Change further by statuses, severities, and/or detections depending on your needs.

    • Check the Include events for messages being added / removed / interacted with in a phishing case box to enable only for higher volume and more sensitive payloads.

  6. Click Save.

Supported log types

Material.NewCaseCreated

The Material.NewCaseCreated schema will be deprecated by Material Security at a future date. Please ensure your Material Security instance and Panther instance is configured to use the Material.IssueChange and Material.AuditLog events listed below.

Material.IssueChange

Material.AuditLog

PreviousLacework ExportNextMicrosoft 365 Logs

Last updated

Was this helpful?