Links

Panther Developer Workflows Overview

Panther Developer Workflows are non-Panther Console workflows you can use to interact with your Panther account
Panther Developer Workflows are non-Panther Console workflows you can use to interact with your Panther account, including continuous integration and continuous deployment (CI/CD), API, the Panther Analysis Tool (PAT), the Pantherlog Tool, and other operational tools.
This page describes the developer workflows and tools you can use with Panther. Panther Developer Workflows are intended for a technical audience who feels comfortable using non-Console workflows.
Our UI-based workflows are documented in detail in the other section of our documentation. To learn more about getting started with Panther Console-based workflows, check out the Quick Start Guide.

CI/CD

Automate your detection pipeline and improve security with a CI/CD workflow: Leverage the Panther-managed detections from the panther-analysis repository in GitHub, adapt the detections to fit into your CI/CD pipeline, and upload the detections to your Panther Console.

Making use of Panther-managed detections

CI/CD users can make use of Panther-managed detections in the panther-analysis repository in GitHub. This can be done by maintaining a public fork of the repo or maintaining a cloned private repository.
The detections in panther-analysis are broadly applicable, but can be customized to ensure that you are receiving only the alerts that are most important to your organization. You will need to pull updates from panther-analysis to take advantage of new detections.
For instructions, see Using the Panther detections repo.

CI/CD workflows

Panther offers CI/CD documentation specific to using the following platforms:
Note that you can adapt these instructions to fit other workflows.

Using the Panther Analysis Tool for CI/CD

PAT is an open-source utility for testing, packaging, and deploying Panther detections from source code. It's designed for developer-centric workflows such as managing your Panther detections programmatically or within CI/CD pipelines.

How your CI/CD workflows interact with the Panther Console

Your uploaded detections will appear alongside detections that were created manually in the Panther Console.
Panther does not support using both a CI/CD workflow and a manual workflow in the Panther Console simultaneously to create and manage detections.

Panther API

Panther offers a public GraphQL-over-HTTP API, meaning you can write GraphQL queries and invoke the API using a typical HTTP request. For more information on GraphQL, please see GraphQL's documentation. The Panther API can integrate with any existing tools that you have. Whether via scripts or CI/CD workflows, the API gives you the ability to automate workflows and complete tasks quickly by codifying processes that would normally require a manual login to the Panther Console.
The Panther API supports operations for alerting, user and role management, data lake queries, and user metrics.

How your API workflows interact with the Panther Console

Panther itself uses an extended version of the API internally, so any changes you make using the Panther API will be immediately reflected in the Panther Console.

Common API use cases

Common use cases include:
  • Managing your users through IaaC and automating Role creation
  • Getting the latest Panther metrics to use in your own dashboards
  • Resolving an alert in Panther as part of an external workflow
  • Running and embedding the results of an Indicator Search query for a particular value
  • Running a custom Data Explorer query whenever a certain event occurs
For full documentation, as well as end-to-end examples in Python and NodeJS, please see Panther API.

Panther tools

Panther provides two developer tools that you can use within your workflows:
  • PAT: An open-source utility for testing, packaging, and deploying Panther detections from source code.
  • Pantherlog: A CLI tool that you can use to infer and parse logs, validate schema files, and run unit tests.