Signals

A signal is created when there's a match on a rule, scheduled rule, or correlation rule

Overview

Correlation rules are in open beta starting with Panther version 1.107, and are available to all customers (except those with Connected Snowflake). Please share any bug reports and feature requests with your Panther support team.

A signal is generated when there is a match on a rule, scheduled rule, or correlation rule. Signals are not generated for policy failures.

A signal represents an action (or a group or series of actions) taking place in your environment that you want to know about, but is not—at least on its own—worthy of generating an alert. Signals are often referred to as "security-relevant events."

Signals are different from rule matches, which are only created when alerting is enabled on a detection. Learn more about the difference between signals, rule matches, and alerts here.

Signal use cases

  • Signals are a building block of correlation rules. In a correlation rule, you specify certain rules, scheduled rules, and correlation rules for which one or more signals must have been generated (or not generated) in a certain time period (amongst other optional criteria) to qualify as a match.

  • You may also want to search for signals in the panther_signals.public database in Search and Data Explorer.

How to create a rule that only produces signals

To create a rule that only produces signals, not rule matches (or alerts), create a rule and configure it to disable alerting.

To create a rule in the Panther Console that only produces signals (not rule matches):

How to view signals

How to view signals for a detection

To view signals for a certain detection, use the View Signals in Search button on its details page. It's also possible to view signals by constructing your own query in Search or Data Explorer.

  1. In the left-hand navigation bar of your Panther Console, click Build > Detections.

  2. Click the name of the detection for which you'd like to view signals.

  3. Towards the upper-right corner of the detection's details page, click View Signals in Search.

    • The Search page will be opened with a pre-populated filter expression for the panther_signals.public database. Click Search.

How to view all signals

You can view signals in Search or Data Explorer.

  1. In the left-hand navigation bar of your Panther Console, click Investigate > Search.

  2. In the database filter, select Signals.

  3. In the table filter, select Correlation Signals.

  4. Click Search.

Last updated