PantherFlow Quick Reference

Overview of PantherFlow functionality

PantherFlow is in open beta starting with Panther version 1.110, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Statements

PantherFlow queries are made up of one or more statements. There are two types of statements:

• Tabular expression statement: Identifies a data source and can include operators separated by pipes

  panther_logs.public.aws_cloudtrail
  | where accountId != '1234567'
  | summarize Count=agg.count() by eventName
  | extend tooHigh = Count > 100

• Let statement: Assigns a tabular expression or a scalar expression to a variable

  // Defining a table variable
  let subquery_name = mytable
  | where foo == 'bar';
  
  // Defining a scalar variable
  let my_search_term = 'quark'
  
  // Referencing table variable and scalar variable
  subquery_name
  | where baz == my_search_term

Operators

Name	Description	Example
<from>	Get data from table	table1
datatable	Use provided test data	datatable [{"foo":"bar"}]
extend	Add a new field	T | extend foo=bar
join	Join with another table	T | join kind=inner dest=(foo) on $left.id == $right.id
limit	Limit the number of rows	T | limit 10
project	Show only certain fields	T | project foo, bar
range	Generate a sequence of rows	range N from 1 to 5 step 1
sort	Sort	T | sort time
search	Text search for a value	T | search 'foo'
summarize	Aggregate	T | summarize agg.count() by foo
union	Query multiple tables	T | union table1, table2
visualize	Generate chart	T | visualize line
where	Filter	T | where foo == bar

Data types

Data type	Example acceptable values
Integer	1, -1
Double	1.0, -1.0
String	'foo', "foo"
Boolean	true, false
Timestamp	time.parse_timestamp('2023-06-01 13:14:15.00Z'), time.parse_timestamp('2023-06-01')
Timespan	15s, 2d, time.parse_timespan('1d')
Object	{key1: value1, key2: value2}, object('key1', 'foo', 'key2', 1)
Array	[A, B, C], array('apple', 'orange')
Table	tableName
Column	columnName
Null	null

Expressions

References

• Array: array[X]
• Objects: object['X'], object.X

Comparisons

• Equality: ==, !=
• Boolean: and, or, not
• Numerical: <, <=, >, >=, +, -, *, /, %
• Arrays: in, not in
• Between: between, not between

Functions

• Anonymous functions: fn ([arg1] [, arg2...]]) { <expr> }

Functions

Aggregations

• agg.avg()
• agg.count()
• agg.count_distinct()
• agg.make_set()
• agg.max()
• agg.min()
• agg.percentile_cont()
• agg.stddev()
• agg.sum()
• agg.take_any()

Date/time

• time.add()
• time.ago()
• time.diff()
• time.now()
• time.parse_timespan()
• time.parse_timestamp()
• time.slice()
• time.trunc()

Strings

• strings.cat()
• strings.contains()
• strings.ends_with()
• strings.ilike()
• strings.join()
• strings.len()
• strings.like()
• strings.lower()
• strings.split()
• strings.starts_with()
• strings.upper()

Arrays

• arrays.difference()
• arrays.filter()
• arrays.flatten()
• arrays.intersection()
• arrays.len()
• arrays.map()
• arrays.overlap()
• arrays.sort()
• arrays.union()

Math

• math.abs()
• math.ceil()
• math.floor()
• math.round()

Control flow

• case()

Data types

• array()
• object()

Other

• coalesce()
• toscalar()

Comments

Write a comment with two slashes:

// a comment