S3 Sources (Beta)

Overview

The S3 Sources API endpoints are in open beta starting with Panther version 1.122, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with S3 Sources in Panther.

Required permissions

• For GET operations, your API token must have the View Log Sources permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Log Sources permission.

create s3 source

post

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Body

application/json

awsAccountIdstringRequired

The 12-digit AWS account ID where the S3 bucket resides

integrationLabelstringRequired

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringRequired

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumRequired

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanRequired

Whether Panther should configure the S3 bucket notifications automatically

s3BucketstringRequired

The S3 bucket name

Responses

201

Created response.

application/json

awsAccountIdstringOptional

The AWS account ID where the S3 bucket resides

integrationIdstringOptional

The unique ID of the S3 log source

integrationLabelstringOptional

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringOptional

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumOptional

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanOptional

Whether Panther should configure the S3 bucket notifications automatically

s3BucketstringOptional

The S3 bucket name

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

post

/log-sources/s3

HTTPcURLJavaScriptPython

POST /log-sources/s3 HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 363

{
  "awsAccountId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

{
  "awsAccountId": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

get s3 source

get

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the S3 source to fetch

Responses

200

OK response.

application/json

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

get

/log-sources/s3/{id}

HTTPcURLJavaScriptPython

GET /log-sources/s3/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "awsAccountId": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

put s3 source

put

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the S3 source to update

Body

application/json

integrationLabelstringRequired

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringRequired

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumRequired

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanRequired

Whether Panther should configure the S3 bucket notifications automatically

Responses

200

OK response.

application/json

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

put

/log-sources/s3/{id}

HTTPcURLJavaScriptPython

PUT /log-sources/s3/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 323

{
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

{
  "awsAccountId": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

delete s3 source

delete

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the S3 source to delete

Responses

204

No Content response.

400

bad_request: Bad Request response.

application/json

500

service: Internal Server Error response.

application/json

delete

/log-sources/s3/{id}

HTTPcURLJavaScriptPython

DELETE /log-sources/s3/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content