Install, Configure, and Authenticate with the Panther Analysis Tool
Get up and running with PAT
Before using the Panther Analysis Tool (PAT) to manage your Panther assets (on your command line or in a CI/CD pipeline, for example), you'll need to install it, provide configuration values, and generate an API token to authenticate. Once you've completed these steps, start running PAT Commands.
To install PAT, your environment must have the following already installed:
To install PAT, run this command:
pip3 install panther_analysis_tool
If you'd prefer instead to run from source for development reasons, first set up your environment:
$ make install
$ pipenv run -- pip3 install -e .
If you would rather use PAT outside of the virtual environment, install it directly:
$ make deps
$ pip3 install -e .
If you are using
pipenv
to manage dependencies, follow the below steps to update PAT:- 1.Update PAT to the latest version in your
Pipfile
. - 2.Run
pipenv install --dev
.
Alternatively, you can update PAT by running the following command:
$ pip3 install panther_analysis_tool --upgrade
PAT can read configuration values from the command line, environment variables, or a configuration file.
The precedence for flag value sources is as follows (highest to lowest):
- 1.Values passed with the command
All options can be passed in through environment variables by prepending the variable name with
PANTHER_.
For example, the
AWS_TOKEN
argument can be passed in through an environment variable named PANTHER_AWS_TOKEN
.PAT will read options from a configuration file called
.panther_settings.yml
located in your working directory. An example configuration file is included in this repo: example_panther_config.yml. It contains example syntax for supported options.PAT requires an API token to authenticate against your Panther instance. Follow these instructions to generate an API token, taking note of the required permissions per PAT command.
When running PAT commands that require an API token, such as
upload
and delete
, you will pass it with the --api-token
option, in addition to the --api-host
option with the GraphQL host.Using an API token to authenticate with PAT means your PAT actions will be captured as Panther Audit Logs.
The token does not expire. As a security best practice, we recommend regularly rotating your API token. For instructions, see Rotating API tokens.
If you are using PAT in CI/CD jobs, be sure to follow your CI/CD provider's instructions on how to manage your API token as a secret—as described on Managing Panther Content via GitHub Actions and Managing Panther Content via CircleCI.
Last modified 13d ago