Managing Scheduled Prompts with the Panther Analysis Tool

Manage Panther AI scheduled prompts as code using PAT

Overview

Scheduled AI prompts run Panther AI analyses automatically on a defined schedule. You can manage them as code — validating, packaging, and uploading them through CI/CD — using the Panther Analysis Tool (PAT), the same way you manage rules and scheduled searches.

Bulk upload is shared-only: a prompt with Private: true is rejected on import. You can download a private prompt for backup, but it will fail to re-import. You can only make a prompt private through the Panther Console.

Prerequisites

• PAT must be installed and authenticated with an API token. Scheduled prompts require API-token authentication (--api-token and --api-host) — AWS-profile authentication is not supported for prompts, because every prompt must have a real owner.

• The API token's role must hold the following permissions:

  • BulkUpload (or BulkUploadValidate for validate only)

  • ManageScheduledPrompts

  • AIRunAsModify — always required when uploading with an API token (a token is never its own RunAsUser); with user authentication, required only when a prompt's RunAsUser is a different user.

• The RunAsUser target (a user or API token) must hold the Run Panther AI permission.

See RBAC for permission details.

Authoring a scheduled prompt

Each prompt is a single YAML document (one prompt per file). When PAT auto-discovers content (run without an explicit --path), folders containing prompts must have scheduled_prompts in their name. When you pass --path directly to a prompts folder (as in the examples below), PAT walks that path regardless of its name.

AnalysisType: scheduled_prompt
PromptName: weekly_iam_review
DisplayName: Weekly IAM Review
Description: Summarize unusual new IAM users created this week.
PromptText: |
  Look at the new IAM users created this week.
  Summarize anything unusual, especially accounts with broad permissions.
OutputLength: medium
Private: false
Enabled: true
RunAsUser: [e-mail]
Schedule:
  CronExpression: "0 9 * * 1"
  TimeoutMinutes: 10

For the full field reference, see Manage scheduled prompts as code.

Validating and uploading

# Validate without writing any changes
pat validate --path ./scheduled_prompts --api-host "$HOST" --api-token "$TOKEN"

# Upload
pat upload --path ./scheduled_prompts --api-host "$HOST" --api-token "$TOKEN"

The upsert key is PromptName (scoped to shared prompts). Re-uploading a file updates the existing shared prompt in place and preserves its owner — it does not create a duplicate.

Retiring a prompt

There is no pat delete for scheduled prompts. To take a prompt out of rotation as-code, set Enabled: false and re-upload. To permanently delete a prompt, use the Panther Console.

Downloading existing prompts

You can export prompts from the Console as YAML to bring them under version control. See Manage scheduled prompts as code.