> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/data-onboarding/supported-logs/material-security.md). # Material Security Logs ## Overview Panther ingests [Material Security](https://material.security/) logs by configuring an Event Subscription in Material to forward events to an HTTP endpoint in Panther. Material Security is a unified email security, user behavior analytics, and data loss prevention solution for Microsoft 365 and Google Workspace. ## **How to onboard Material Security logs to Panther** ### Step 1: Create a new Material Security source in Panther To connect these logs into Panther: 1. In the left-hand navigation bar of your Panther Console, click **Log Sources**. 2. Click **Create New**. 3. Search for “Material Security,” then click its tile. 4. Click **Start Setup**. 5. Follow Panther's [instructions for configuring an HTTP Source](https://docs.panther.com/data-onboarding/data-transports/http#how-to-set-up-an-http-log-source-in-panther), beginning at Step 5. * In the **Auth method** dropdown field, select **Bearer**. * Payloads sent to this source are subject to the [payload requirements for all HTTP sources](https://docs.panther.com/data-onboarding/data-transports/http#payload-requirements). * Do not proceed to the next step until the creation of your HTTP endpoint has completed. ### Step 2: Create an Event Subscription in Material Security 1. Log into your Material Security tenant. 2. In the top tool bar, click **Integrations**. 3. Scroll down to **SIEM**, then click **Panther**. 4. Enter values for the following fields: * **Method**: Set to **POST** * **URI**: Your Panther HTTP source * **Headers**: Add the bearer token you entered or generated in Panther in [Step 1](#step-1-create-a-new-material-security-source-in-panther) * For example: `{ "Authorization": "Bearer " }` 5. **Events**: `Issue Change` and `Audit Log Updated` are pre-configured by default. * By default, the webhook triggers any issue change occurs **or** the audit log\ updates. * Optionally, click the **Issue Change** event row to edit. * Consider filtering `Issue Change` further by statuses, severities, and/or detections depending on your needs. * Check the `Include events for messages being added / removed / interacted with in a phishing case` box to enable only for higher volume and more sensitive payloads. 6. Click **Save**. ## Supported log types ### Material.NewCaseCreated {% hint style="warning" %} The `Material.NewCaseCreated` schema will be deprecated by Material Security at a future date. Please ensure your Material Security instance and Panther instance is configured to use the `Material.IssueChange` and `Material.AuditLog` events listed below. {% endhint %} ```yaml schema: Material.NewCaseCreated description: Cases created in Material referenceURL: https://material.security/ fields: - name: caseCreated required: true type: object fields: - name: _internal type: object fields: - name: internalAllMarks type: array element: type: object fields: - name: markedBy type: object fields: - name: acctEmail type: string indicators: - email - name: acctId type: string - name: csp type: string - name: isAdmin type: boolean - name: uAcctId type: string - name: userReport type: object fields: - name: job type: object fields: - name: jobId type: string - name: jobType type: string - name: reportedInMsftReportMsgAddin type: boolean - name: reportedInOutlookAddin type: boolean - name: labelName type: string - name: reportedStub type: boolean - name: ruleMatch type: object fields: - name: id type: string - name: markedAt type: string - name: internalMark type: object fields: - name: markedBy type: object fields: - name: acctEmail type: string - name: acctId type: string - name: csp type: string - name: isAdmin type: boolean - name: uAcctId type: string - name: userReport type: object fields: - name: job type: object fields: - name: jobId type: string - name: jobType type: string - name: reportedInMsftReportMsgAddin type: boolean - name: reportedInOutlookAddin type: boolean - name: labelName type: string - name: reportedStub type: boolean - name: ruleMatch type: object fields: - name: id type: string - name: markedAt type: string - name: caseId type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: createdBy type: object fields: - name: system type: boolean - name: mark type: object fields: - name: userReport type: object fields: - name: reportingMethod type: string - name: ruleMatch type: object fields: - name: ruleId type: string - name: ruleName type: string - name: ruleProvenanceType type: string - name: markType type: string - name: markedAt type: timestamp timeFormats: - rfc3339 - name: markedBy type: object fields: - name: actor type: object fields: - name: acctEmail type: string indicators: - email - name: acctId type: string - name: csp type: string - name: isAdmin type: boolean - name: uAcctId type: string - name: system type: boolean - name: messageId type: string - name: eventId type: string - name: forCase type: object fields: - name: caseId type: string - name: info type: object fields: - name: remedyHistory type: array element: type: object fields: - name: reason type: object fields: - name: userReport type: object fields: - name: global type: boolean - name: rule type: object fields: - name: ruleId type: string - name: remedy type: object fields: - name: markSpam type: object fields: - name: selected type: boolean - name: vaxAllow type: object fields: - name: selected type: boolean - name: vaxDeny type: object fields: - name: selected type: boolean - name: vaxTeach type: object fields: - name: message type: string - name: selected type: boolean - name: vaxBanner type: object fields: - name: message type: string - name: selected type: boolean - name: reporterAcknowledgementConfig type: object fields: - name: acknowledgeNewReporters type: boolean - name: acknowledgePreviousReporters type: boolean - name: acknowledgementMessage type: string - name: id type: string - name: type type: string - name: version type: string - name: judgedBy type: string - name: caseAnalysis type: object fields: - name: caseId type: string - name: completedAt type: timestamp timeFormats: - rfc3339 - name: judgement type: string - name: reasons type: array element: type: string - name: type type: string - name: caseAnalysisHistory type: array element: type: object fields: - name: caseId type: string - name: completedAt type: timestamp timeFormats: - rfc3339 - name: judgement type: string - name: reasons type: array element: type: string - name: type type: string - name: recommendedJudgementCategory type: string - name: orgId type: string - name: caseId type: string - name: closedStatus type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: hasNovelDomain type: boolean - name: hasNovelSender type: boolean - name: isHistorical type: boolean - name: isShadow type: boolean - name: judgedAt type: string - name: judgementCategory type: string - name: judgementHistory type: array element: type: object fields: - name: judgedBy type: string - name: recommendedJudgementCategory type: string - name: judgedAt type: timestamp timeFormats: - rfc3339 - name: judgementCategory type: string - name: judgementReason type: object fields: - name: default type: boolean - name: adminReport type: boolean - name: caseClassification type: boolean - name: modelName type: string - name: modelVersion type: string - name: reasons type: array element: type: string - name: score type: float - name: rule type: object fields: - name: custom type: object fields: - name: ruleId type: string - name: builtIn type: object fields: - name: ruleId type: string - name: judgementReason type: object fields: - name: default type: boolean - name: adminReport type: boolean - name: caseClassification type: boolean - name: modelName type: string - name: modelVersion type: string - name: reasons type: array element: type: string - name: score type: float - name: rule type: object fields: - name: custom type: object fields: - name: ruleId type: string - name: builtIn type: object fields: - name: ruleId type: string - name: newMarkedMessagesCount type: bigint - name: newSimilarMessagesCount type: bigint - name: remediateSimilarMessages type: boolean - name: remedy type: object fields: - name: reason type: object fields: - name: userReport type: object fields: - name: global type: boolean - name: rule type: object fields: - name: ruleId type: string - name: remedy type: object fields: - name: vaxTeach type: object fields: - name: message type: string - name: selected type: boolean - name: markSpam type: object fields: - name: selected type: boolean - name: vaxDeny type: object fields: - name: selected type: boolean - name: vaxBanner type: object fields: - name: message type: string - name: selected type: boolean - name: vaxAllow type: object fields: - name: selected type: boolean - name: reporterAcknowledgementConfig type: object fields: - name: acknowledgeNewReporters type: boolean - name: acknowledgePreviousReporters type: boolean - name: acknowledgementMessage type: string - name: id type: string - name: type type: string - name: version type: string - name: reviewedStatus type: string - name: shouldInvestigate type: boolean - name: updatedAt type: timestamp timeFormats: - rfc3339 - name: status type: object fields: - name: caseId type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: investigation type: object fields: - name: override type: object fields: - name: createdAt type: timestamp timeFormats: - rfc3339 - name: isShadow type: boolean - name: remedy type: object fields: - name: reason type: object fields: - name: userReport type: object fields: - name: global type: boolean - name: rule type: object fields: - name: ruleId type: string - name: remedy type: object fields: - name: vaxTeach type: object fields: - name: message type: string - name: selected type: boolean - name: markSpam type: object fields: - name: selected type: boolean - name: vaxDeny type: object fields: - name: selected type: boolean - name: vaxBanner type: object fields: - name: message type: string - name: selected type: boolean - name: vaxAllow type: object fields: - name: selected type: boolean - name: reporterAcknowledgementConfig type: object fields: - name: acknowledgeNewReporters type: boolean - name: acknowledgePreviousReporters type: boolean - name: acknowledgementMessage type: string - name: id type: string - name: type type: string - name: version type: string - name: remedyHistory type: array element: type: object fields: - name: reason type: object fields: - name: userReport type: object fields: - name: global type: boolean - name: rule type: object fields: - name: ruleId type: string - name: remedy type: object fields: - name: vaxTeach type: object fields: - name: message type: string - name: selected type: boolean - name: markSpam type: object fields: - name: selected type: boolean - name: vaxDeny type: object fields: - name: selected type: boolean - name: vaxBanner type: object fields: - name: message type: string - name: selected type: boolean - name: vaxAllow type: object fields: - name: selected type: boolean - name: reporterAcknowledgementConfig type: object fields: - name: acknowledgeNewReporters type: boolean - name: acknowledgePreviousReporters type: boolean - name: acknowledgementMessage type: string - name: id type: string - name: type type: string - name: version type: string - name: reviewed type: object fields: - name: status type: string - name: forMessage type: object fields: - name: json type: object fields: - name: inReplyTo type: string - name: sender type: string - name: xMailer type: string - name: inReplyTos type: array element: type: string - name: references type: array element: type: string - name: rawReplyTo type: array element: type: string - name: replyTo type: array element: type: string - name: dkim type: string - name: dmarc type: string - name: spf type: string - name: received type: array element: type: string - name: acctEmail type: string indicators: - email - name: acctId type: string - name: attachmentIds type: array element: type: string - name: attachmentMimes type: array element: type: string - name: attachmentNames type: array element: type: string - name: attachments type: array element: type: object fields: - name: attachId type: string - name: filename type: string - name: md5 type: string indicators: - md5 - name: mime type: string - name: sha256 type: string indicators: - sha256 - name: size type: bigint - name: store type: string - name: date type: timestamp timeFormats: - rfc3339 - name: from type: string - name: headers type: array element: type: object fields: - name: k type: string - name: v type: string - name: host type: string - name: hostDate type: timestamp timeFormats: - rfc3339 - name: hostFlags type: object fields: - name: isDraft type: boolean - name: isInbox type: boolean - name: isRetrieved type: boolean - name: isSent type: boolean - name: isSpam type: boolean - name: isTrash type: boolean - name: isUnread type: boolean - name: hostMsgId type: string - name: hostTags type: array element: type: string - name: hostThreadId type: string - name: isDiagnostic type: boolean - name: isPurgatoryV2 type: boolean - name: isStub type: boolean - name: links type: array element: type: object fields: - name: text type: string - name: href type: string - name: messageId type: string - name: numAttachments type: bigint - name: parts type: array element: type: object fields: - name: attachmentType type: string - name: attachId type: string - name: filename type: string - name: md5 type: string indicators: - md5 - name: sha256 type: string indicators: - sha256 - name: store type: string - name: text type: string - name: headers type: array element: type: object fields: - name: k type: string - name: v type: string - name: mime type: string - name: path type: string - name: size type: bigint - name: rawFrom type: array element: type: string - name: rawTo type: array element: type: string - name: receivedDates type: array element: type: timestamp timeFormats: - rfc3339 - name: snippet type: string - name: snippetMime type: string - name: subject type: string - name: to type: array element: type: string - name: totalSize type: bigint - name: uDomainId type: string - name: key type: array element: type: string - name: getMaterialBaseUrl type: object fields: - name: url type: string indicators: - url - name: timestamp type: timestamp timeFormats: - rfc3339 isEventTime: true ``` ### Material.IssueChange ```yaml schema: Material.IssueChange description: Issue change events from Material referenceURL: https://material.security/ fields: - name: account type: object fields: - name: email type: string indicators: - email - name: uAcctId type: string - name: after type: object fields: - name: status type: string - name: before type: object fields: - name: status type: string - name: eventId type: string - name: issue required: true type: object fields: - name: detectionId type: string - name: id type: string - name: severity type: string - name: status type: string - name: messageChange type: json - name: tenant type: object fields: - name: uDomainId type: string - name: timestamp required: true type: timestamp timeFormats: - rfc3339 isEventTime: true - name: type type: string ``` ### Material.AuditLog ```yaml schema: Material.AuditLog description: Audit log events from Material referenceURL: https://material.security/ fields: - name: eventId type: string - name: timestamp required: true type: timestamp timeFormats: - rfc3339 isEventTime: true - name: orgId type: string - name: uDomainId type: string - name: edgeUDomainId type: string - name: tenantIdApiV1 type: string - name: getMaterialBaseUrl type: object fields: - name: url type: string indicators: - url - name: auditLog required: true type: object fields: - name: category type: string - name: action type: string - name: actor type: object fields: - name: secretManagerClientId type: string - name: ip type: string indicators: - ip - name: realm type: object fields: - name: domains type: string - name: uDomainIds type: array element: type: string - name: metadata type: object fields: - name: permIds type: array element: type: string - name: match type: string - name: rolesPresent type: array element: type: string - name: system type: boolean - name: user type: object fields: - name: id type: bigint - name: orgId type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: updatedAt type: timestamp timeFormats: - rfc3339 - name: displayName type: string - name: givenName type: string - name: familyName type: string - name: contactEmail type: string indicators: - email - name: pylonEmailHash type: string - name: permIds type: array element: type: string - name: accts type: array element: type: object fields: - name: uAcctId type: string - name: uDomainId type: string - name: edgeUDomainId type: string - name: target type: object fields: - name: global type: boolean - name: globalAllDomains type: boolean - name: domains type: array element: type: string - name: message type: object fields: - name: hId type: string - name: date type: timestamp timeFormats: - rfc3339 - name: group type: object fields: - name: uGroupId type: string - name: name type: string - name: type type: string - name: account type: object fields: - name: uAcctId type: string - name: displayName type: string - name: acctEmail type: string indicators: - email - name: externalAccount type: object fields: - name: emailAddress type: string indicators: - email - name: case type: object fields: - name: caseId type: string - name: uDomainId type: string - name: repMessage type: object fields: - name: hId type: string - name: uAcctId type: string - name: from type: string - name: date type: string - name: subject type: string - name: spf type: string - name: dkim type: string - name: dmarc type: string - name: numLinks type: bigint - name: numAttachments type: bigint - name: file type: object fields: - name: fileId type: string - name: filePolicy type: object fields: - name: policyId type: string - name: uDomainId type: string - name: apiToken type: object fields: - name: clientId type: string - name: detection type: object fields: - name: id type: string - name: issue type: object fields: - name: id type: string - name: customView type: object fields: - name: id type: bigint - name: name type: string - name: visibility type: string - name: uDomainId type: string - name: trustedEntity type: object fields: - name: id type: string - name: change type: object fields: - name: before type: json - name: after type: json - name: changed type: array element: type: string - name: details type: object fields: - name: case_shared type: object fields: - name: feedback type: object fields: - name: source type: string - name: comment type: string - name: attackCategory type: array element: type: string - name: agree type: boolean - name: reason type: string - name: cases_merged type: object fields: - name: mergeIntoCaseId type: string - name: mergedCaseIds type: array element: type: string - name: message_search_performed type: object fields: - name: query type: string - name: options type: object fields: - name: warehouse type: string - name: includeDrafts type: boolean - name: isSensitive type: boolean - name: isSuspicious type: boolean - name: isDetectedMessages type: boolean - name: inCaseState type: string - name: exemptFromCase type: boolean - name: types type: array element: type: string - name: suspiciousTypes type: array element: type: string - name: rules type: array element: type: string - name: rulesQuery type: object fields: - name: evaluationEnabled type: boolean - name: implicationEnabled type: boolean - name: forceEvaluate type: boolean - name: isValid type: boolean - name: isDeprecated type: boolean - name: ids type: array element: type: string - name: versionIds type: array element: type: object fields: - name: id type: string - name: version type: string - name: implications type: array element: type: string - name: uDomainIds type: array element: type: string - name: includeEmptyRules type: boolean - name: versionedIds type: array element: type: string - name: provenanceTypes type: array element: type: object fields: - name: builtIn type: object fields: - name: release type: object fields: - name: created type: boolean - name: remote type: object fields: - name: created type: boolean - name: custom type: object fields: - name: api type: object fields: - name: created type: boolean - name: search type: object fields: - name: created type: boolean - name: thirdParty type: object fields: - name: microsoft type: object fields: - name: created type: boolean - name: isMaterialOwned type: boolean - name: serviceIds type: array element: type: string - name: isVerifiedDelivery type: boolean - name: purgatoryReason type: string - name: withinDays type: bigint - name: startDate type: timestamp timeFormats: - rfc3339 - name: endDate type: timestamp timeFormats: - rfc3339 - name: excludeBufferRole type: string - name: useExactMatch type: boolean - name: uDomainIds type: array element: type: string - name: includeShadowModeSuspiciousRulesMatches type: boolean - name: message_list_viewed type: object fields: - name: options type: object fields: - name: warehouse type: string - name: includeDrafts type: boolean - name: isSensitive type: boolean - name: isSuspicious type: boolean - name: isDetectedMessages type: boolean - name: inCaseState type: string - name: exemptFromCase type: boolean - name: types type: array element: type: string - name: suspiciousTypes type: array element: type: string - name: rules type: array element: type: string - name: rulesQuery type: object fields: - name: evaluationEnabled type: boolean - name: implicationEnabled type: boolean - name: forceEvaluate type: boolean - name: isValid type: boolean - name: isDeprecated type: boolean - name: ids type: array element: type: string - name: versionIds type: array element: type: object fields: - name: id type: string - name: version type: string - name: implications type: array element: type: string - name: uDomainIds type: array element: type: string - name: includeEmptyRules type: boolean - name: versionedIds type: array element: type: string - name: provenanceTypes type: array element: type: object fields: - name: builtIn type: object fields: - name: release type: object fields: - name: created type: boolean - name: remote type: object fields: - name: created type: boolean - name: custom type: object fields: - name: api type: object fields: - name: created type: boolean - name: search type: object fields: - name: created type: boolean - name: thirdParty type: object fields: - name: microsoft type: object fields: - name: created type: boolean - name: isMaterialOwned type: boolean - name: serviceIds type: array element: type: string - name: isVerifiedDelivery type: boolean - name: purgatoryReason type: string - name: withinDays type: bigint - name: startDate type: timestamp timeFormats: - rfc3339 - name: endDate type: timestamp timeFormats: - rfc3339 - name: excludeBufferRole type: string - name: useExactMatch type: boolean - name: uDomainIds type: array element: type: string - name: includeShadowModeSuspiciousRulesMatches type: boolean - name: mql_message_search_performed type: object fields: - name: query type: string - name: startDate type: timestamp timeFormats: - rfc3339 - name: endDate type: timestamp timeFormats: - rfc3339 - name: uDomainIds type: array element: type: string - name: classification type: string - name: message_attachment_downloaded type: object fields: - name: name type: string - name: message_shared type: object fields: - name: reason type: string - name: comment type: string - name: message_deleted type: object fields: - name: numRequested type: bigint - name: uAcctId type: string - name: searchQuery type: string - name: groupListId type: string - name: isFullDelete type: boolean - name: sensitive_mark_changed type: object fields: - name: numRequested type: bigint - name: markType type: string - name: uAcctId type: string - name: searchQuery type: string - name: groupListId type: string - name: suspicious_mark_changed type: object fields: - name: numRequested type: bigint - name: searchQuery type: string - name: groupListId type: string - name: account_unlock_job_created type: object fields: - name: acctEmail type: string indicators: - email - name: jobStarted type: timestamp timeFormats: - rfc3339 - name: messagesFound type: bigint - name: messagesUnlocked type: bigint - name: runtimeMinutes type: bigint - name: account_unlock_job_started type: object fields: - name: acctEmail type: string indicators: - email - name: jobStarted type: timestamp timeFormats: - rfc3339 - name: messagesFound type: bigint - name: messagesUnlocked type: bigint - name: runtimeMinutes type: bigint - name: account_unlock_job_done type: object fields: - name: acctEmail type: string indicators: - email - name: jobStarted type: timestamp timeFormats: - rfc3339 - name: messagesFound type: bigint - name: messagesUnlocked type: bigint - name: runtimeMinutes type: bigint - name: acct_csp_update type: object fields: - name: google type: object fields: - name: updates type: object fields: - name: gmailAutoForwarding type: object fields: - name: disposition type: string - name: emailAddress type: string indicators: - email - name: enabled type: boolean - name: gmailPop type: object fields: - name: accessWindow type: string - name: disposition type: string - name: gmailImap type: object fields: - name: autoExpunge type: boolean - name: enabled type: boolean - name: expungeBehavior type: string - name: maxFolderSize type: bigint - name: gmailRuleForwarding type: array element: type: object fields: - name: id type: string - name: criteria type: object fields: - name: from type: string - name: to type: string - name: subject type: string - name: query type: string - name: negatedQuery type: string - name: hasAttachment type: boolean - name: excludeChats type: boolean - name: size type: bigint - name: sizeComparison type: string - name: action type: object fields: - name: addLabelIds type: array element: type: string - name: removeLabelIds type: array element: type: string - name: forward type: string - name: deletes type: object fields: - name: gmailPop type: boolean - name: gmailImap type: boolean - name: gmailAutoForwarding type: boolean - name: gmailRuleForwarding type: object fields: - name: all type: boolean - name: individual type: array element: type: object fields: - name: uAcctId type: string - name: filterId type: string - name: googleAsps type: object fields: - name: all type: boolean - name: individual type: array element: type: object fields: - name: uAcctId type: string - name: codeId type: bigint - name: revokeUserSessions type: boolean - name: microsoft type: object fields: - name: deletes type: object fields: - name: revokeUserSessions type: boolean - name: file_search_performed type: object fields: - name: query type: string - name: options type: object fields: - name: warehouse type: string - name: includeDrafts type: boolean - name: isSensitive type: boolean - name: isSuspicious type: boolean - name: isDetectedMessages type: boolean - name: inCaseState type: string - name: exemptFromCase type: boolean - name: types type: array element: type: string - name: suspiciousTypes type: array element: type: string - name: rules type: array element: type: string - name: rulesQuery type: object fields: - name: evaluationEnabled type: boolean - name: implicationEnabled type: boolean - name: forceEvaluate type: boolean - name: isValid type: boolean - name: isDeprecated type: boolean - name: ids type: array element: type: string - name: versionIds type: array element: type: object fields: - name: id type: string - name: version type: string - name: implications type: array element: type: string - name: uDomainIds type: array element: type: string - name: includeEmptyRules type: boolean - name: versionedIds type: array element: type: string - name: provenanceTypes type: array element: type: object fields: - name: builtIn type: object fields: - name: release type: object fields: - name: created type: boolean - name: remote type: object fields: - name: created type: boolean - name: custom type: object fields: - name: api type: object fields: - name: created type: boolean - name: search type: object fields: - name: created type: boolean - name: thirdParty type: object fields: - name: microsoft type: object fields: - name: created type: boolean - name: isMaterialOwned type: boolean - name: serviceIds type: array element: type: string - name: isVerifiedDelivery type: boolean - name: purgatoryReason type: string - name: withinDays type: bigint - name: startDate type: timestamp timeFormats: - rfc3339 - name: endDate type: timestamp timeFormats: - rfc3339 - name: excludeBufferRole type: string - name: useExactMatch type: boolean - name: uDomainIds type: array element: type: string - name: includeShadowModeSuspiciousRulesMatches type: boolean - name: file_list_viewed type: object fields: - name: options type: object fields: - name: uDomainIds type: array element: type: string - name: file_permissions_revoked type: object fields: - name: fileName type: string - name: fileId type: string - name: fileUrl type: string indicators: - url - name: successfullyRemovedPermissions type: array element: type: object fields: - name: id type: string - name: displayName type: string - name: emailAddress type: string indicators: - email - name: notFound type: boolean - name: file_permissions_updated type: object fields: - name: fileName type: string - name: fileId type: string - name: fileUrl type: string indicators: - url - name: successfullyRemovedPermissions type: array element: type: object fields: - name: id type: string - name: displayName type: string - name: emailAddress type: string indicators: - email - name: notFound type: boolean - name: accessLevel type: string - name: file_labels_updated type: object fields: - name: fileName type: string - name: fileId type: string - name: fileUrl type: string indicators: - url - name: successfullyRemovedLabels type: array element: type: object fields: - name: id type: string - name: labelName type: string - name: notFound type: boolean - name: custom_category type: object fields: - name: id type: string - name: displayName type: string - name: material_detection_matches_viewed type: object fields: - name: options type: object fields: - name: warehouse type: string - name: includeDrafts type: boolean - name: isSensitive type: boolean - name: isSuspicious type: boolean - name: isDetectedMessages type: boolean - name: inCaseState type: string - name: exemptFromCase type: boolean - name: types type: array element: type: string - name: suspiciousTypes type: array element: type: string - name: rules type: array element: type: string - name: rulesQuery type: object fields: - name: evaluationEnabled type: boolean - name: implicationEnabled type: boolean - name: forceEvaluate type: boolean - name: isValid type: boolean - name: isDeprecated type: boolean - name: ids type: array element: type: string - name: versionIds type: array element: type: object fields: - name: id type: string - name: version type: string - name: implications type: array element: type: string - name: uDomainIds type: array element: type: string - name: includeEmptyRules type: boolean - name: versionedIds type: array element: type: string - name: provenanceTypes type: array element: type: object fields: - name: builtIn type: object fields: - name: release type: object fields: - name: created type: boolean - name: remote type: object fields: - name: created type: boolean - name: custom type: object fields: - name: api type: object fields: - name: created type: boolean - name: search type: object fields: - name: created type: boolean - name: thirdParty type: object fields: - name: microsoft type: object fields: - name: created type: boolean - name: isMaterialOwned type: boolean - name: serviceIds type: array element: type: string - name: isVerifiedDelivery type: boolean - name: purgatoryReason type: string - name: withinDays type: bigint - name: startDate type: timestamp timeFormats: - rfc3339 - name: endDate type: timestamp timeFormats: - rfc3339 - name: excludeBufferRole type: string - name: useExactMatch type: boolean - name: uDomainIds type: array element: type: string - name: includeShadowModeSuspiciousRulesMatches type: boolean - name: issue_viewed type: object fields: - name: id type: string - name: entityType type: string - name: uDomainId type: string - name: uAcctId type: string - name: uGroupId type: string - name: uFileId type: string - name: messageId type: string - name: msgDate type: timestamp timeFormats: - rfc3339 - name: appId type: string - name: appType type: string - name: detectionId type: string - name: detectionType type: string - name: status type: string - name: issue_comment_added type: object fields: - name: comment type: string - name: custom_view_created type: object fields: - name: viewId type: bigint - name: name type: string - name: visibility type: string - name: hasFilters type: boolean - name: hasSorting type: boolean - name: hasGrouping type: boolean - name: hasQuery type: boolean - name: hasDisplayOptions type: boolean - name: custom_view_deleted type: object fields: - name: viewId type: bigint - name: name type: string - name: visibility type: string - name: create_integration type: object fields: - name: id type: string - name: type type: string - name: delete_integration type: object fields: - name: id type: string - name: type type: string - name: event_subscription_created type: object fields: - name: name type: string - name: id type: string - name: event_subscription_edited type: object fields: - name: name type: string - name: id type: string - name: enabled type: boolean - name: event_subscription_deleted type: object fields: - name: name type: string - name: id type: string - name: login type: object fields: - name: accountEmail type: string indicators: - email - name: invitedEmail type: string indicators: - email - name: api_request_attempted type: object fields: - name: url type: string indicators: - url - name: method type: string - name: role_changed type: object fields: - name: added type: json - name: unchanged type: json - name: removed type: json - name: groupRoleBindings type: json - name: groupMembership type: json - name: resync type: object fields: - name: request type: string - name: challenge_bypass_created type: object fields: - name: id type: string - name: orgId type: string - name: entityId type: object fields: - name: type type: string - name: uDomainId type: string - name: uAcctId type: string - name: bypassUntil type: timestamp timeFormats: - rfc3339 - name: creatorUserId type: bigint - name: rationale type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: challenge_bypass_updated type: object fields: - name: id type: string - name: orgId type: string - name: entityId type: object fields: - name: type type: string - name: uDomainId type: string - name: uAcctId type: string - name: bypassUntil type: timestamp timeFormats: - rfc3339 - name: creatorUserId type: bigint - name: rationale type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: challenge_bypass_deleted type: object fields: - name: id type: string - name: orgId type: string - name: entityId type: object fields: - name: type type: string - name: uDomainId type: string - name: uAcctId type: string - name: bypassUntil type: timestamp timeFormats: - rfc3339 - name: creatorUserId type: bigint - name: rationale type: string - name: createdAt type: timestamp timeFormats: - rfc3339 - name: challenge_bypassed type: object fields: - name: id type: string - name: challengedResourceId type: string - name: challengeProfileType type: string - name: trusted_entity_created type: object fields: - name: entity type: object fields: - name: id type: string - name: orgId type: string - name: lastTouchedAt type: timestamp timeFormats: - rfc3339 - name: lastTouchedBy type: string - name: entityId type: string - name: uDomainId type: string - name: includeSubdomains type: boolean - name: ignorePhishingReports type: boolean - name: ignoreEmailAuthenticationResults type: boolean - name: ignoreExternalAccessRevocation type: boolean - name: skipRepAck type: boolean - name: createSafeIssues type: boolean - name: category type: string - name: type type: string - name: enabled type: boolean - name: timelineEvents type: array element: type: object fields: - name: timestamp type: timestamp timeFormats: - rfc3339 - name: event type: string - name: uAcctId type: string - name: commentValue type: string - name: settingName type: string - name: settingValueBefore type: boolean - name: settingValueAfter type: boolean - name: isEnrolled type: boolean - name: canBeDeleted type: boolean - name: trusted_entity_comment_added type: object fields: - name: commentValue type: string - name: vip_added type: object fields: - name: uAcctId type: string - name: emailAliases type: array element: type: string indicators: - email - name: displayNames type: array element: type: string - name: error type: object fields: - name: type type: string - name: message type: string ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.panther.com/data-onboarding/supported-logs/material-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.