For the complete documentation index, see llms.txt. This page is also available as Markdown.

Managing Scheduled Prompts with the Panther Analysis Tool

Manage Panther AI scheduled prompts as code using PAT

Overview

Scheduled AI prompts run Panther AI analyses automatically on a defined schedule. You can manage them as code — validating, packaging, and uploading them through CI/CD — using the Panther Analysis Tool (PAT), the same way you manage rules and scheduled searches.

Prerequisites

  • PAT must be installed and authenticated with an API token. Scheduled prompts require API-token authentication (--api-token and --api-host) — AWS-profile authentication is not supported for prompts, because every prompt must have a real owner.

  • The API token's role must hold the following permissions:

    • BulkUpload (or BulkUploadValidate for validate only)

    • ManageScheduledPrompts

    • AIRunAsModify — always required when uploading with an API token (a token is never its own RunAsUser); with user authentication, required only when a prompt's RunAsUser is a different user.

  • The RunAsUser target (a user or API token) must hold the Run Panther AI permission.

See RBAC for permission details.

Authoring a scheduled prompt

Each prompt is a single YAML document (one prompt per file). When PAT auto-discovers content (run without an explicit --path), folders containing prompts must have scheduled_prompts in their name. When you pass --path directly to a prompts folder (as in the examples below), PAT walks that path regardless of its name.

AnalysisType: scheduled_prompt
PromptName: weekly_iam_review
DisplayName: Weekly IAM Review
Description: Summarize unusual new IAM users created this week.
PromptText: |
  Look at the new IAM users created this week.
  Summarize anything unusual, especially accounts with broad permissions.
OutputLength: medium
Private: false
Enabled: true
RunAsUser: alice@example.com
Schedule:
  CronExpression: "0 9 * * 1"
  TimeoutMinutes: 10

For the full field reference, see Manage scheduled prompts as code.

Validating and uploading

The upsert key is PromptName (scoped to shared prompts). Re-uploading a file updates the existing shared prompt in place and preserves its owner — it does not create a duplicate.

Retiring a prompt

There is no pat delete for scheduled prompts. To take a prompt out of rotation as-code, set Enabled: false and re-upload. To permanently delete a prompt, use the Panther Console.

Downloading existing prompts

You can export prompts from the Console as YAML to bring them under version control. See Manage scheduled prompts as code.

Last updated

Was this helpful?