Onboarding Guide

Set up your Panther environment
Overview
Onboarding in Panther means setting up log sources, detections, and alert destinations, as well as familiarizing yourself with search tools and optionally enabling enrichment capabilities. This guide will walk you through each of these tasks.
If you need help while onboarding, feel free to reach out to your Panther support team.
Prerequisite
You have successfully logged in to your Panther Console.
Step 1: Onboard log sources
The first step in configuring your Panther environment is to onboard log sources, which provide data to Panther to analyze and store. After identifying valuable sources, you'll onboard each one.
Step 1.1: Identify log sources to onboard
Consider the log-emitting systems in your environment that you'd like to monitor for security. It's recommended to onboard enough sources to come close to your allowed ingest volume. You can use log filtering if you would only like to ingest some logs from a certain source into Panther.
If you need some ideas of where to get started, review the Supported Logs list. You can also onboard completely custom sources.
Step 1.2: Onboard each log source
For each of the log sources you've identified as wanting to ingest:
If the log source is one of Panther's supported sources, onboard it by following the instructions on its documentation page.
If the log source is not one of Panther's supported sources:
1.If the source is able to emit event webhooks:
If the source is high-volume (emits at least one GB per hour) and/or its payload size exceeds the HTTP payload limit, skip to number two.
1.Onboard the source by following the HTTP Source creation instructions.
2.Follow the instructions to infer a custom schema from HTTP data received in Panther.
2.If the source is not able to emit event webhooks but can export events to an S3 bucket:
1.Onboard the source by following the S3 Source creation instructions.
2.Follow the instructions to infer a custom schema in one of the following ways:
​From S3 data received in Panther​
​From historical S3 data​
3.If the source is not able to emit event webhooks nor export events to an S3 bucket, but can export events to one of the other Data Transport locations Panther can pull from, e.g., Google Cloud Storage or Azure Blob Storage:
1.Define a custom schema in one of the following ways:
​Inferring from sample logs in the Console​
​Inferring using pantherlog infer​
​Creating one manually in the Console​
2.Onboard the source by following the instructions within the documentation for your chosen Data Transport.
4.If the source is not able to emit event webhooks nor export events to any of Panther's Data Transport sources, see Panther's Data Pipeline Tools guides or reach out to your Panther support team for assistance in connecting your data to Panther.
These instructions are also represented in the flow chart below:
(Optional) Step 1.3: Onboard AWS account(s) for Cloud Security Scanning
If you use AWS as a cloud provider, you can use Panther's Cloud Security Scanning feature to monitor the configurations of your cloud resources.
If you'd like to use Cloud Security Scanning, onboard one or more AWS accounts by following these instructions.
​
Log sources: Go further
Learn how to monitor the health of your log sources​
Learn about field discovery for custom log sources
If you created any custom schemas, designate fields as Indicator Fields to enable cross-log search and detections
Step 2: Create or enable detections
Now that your data is flowing into Panther, it's time to configure detections. First, you'll choose whether to manage detection content in the Panther Console or CLI workflow. Then, for each source, you'll enable Panther-managed detections or create your own.
After you have created or enabled detections, alerts for matches will be visible in your Panther Console and queryable via the Panther API—but you will not receive alerts in external applications until you complete the next step, to set up alert destinations.
Step 2.1: Choose the Console or CLI workflow for detection management
Decide whether you'd like to manage detection content in the Panther Console or in the CLI workflow (performing uploads using the Panther Analysis Tool [PAT], perhaps in a CI/CD pipeline). Detection content includes detection packs and detections themselves (rules, scheduled rules, and policies), as well as data models, global helpers, lookup tables, saved queries, and scheduled queries. Managing detection content in both the Console and CLI workflows is unsupported.
You might choose to use the CLI workflow if your team is comfortable using git, command line tools, and CI/CD pipelines. Otherwise, it's recommended to use the Panther Console.
Panther's Simple Detections functionality aims to eventually integrate the Console and CLI workflows. Currently, if your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will still be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).
Step 2.2: Create or enable rules and scheduled rules for each log source
For each of the log sources you onboarded to Panther in the previous step, you will enable Panther-managed detections or create your own. If the source is one of Panther's Supported Logs, follow the Supported logs section below. Otherwise, follow the Custom logs section.
Supported logs
If the source is one of Panther's Supported Logs:
Enable a Panther-managed Detection Pack for the source. See the instructions below for enabling a Detection Pack in the Panther Console and in the CLI workflow.
If you already enabled a Detection Pack for this log source during onboarding (on the final "Success!" page), move on to the next log source.
Console
CLI
Enable a Panther-managed Detection Pack in the Console
Follow these instructions to enable a Panther-managed Detection Pack for the source.
Go further:
Learn how to customize a Panther-managed detection.
Create additional, custom detections for this source.
Enable a Panther-managed Detection Pack in the CLI workflow
1.If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.
2.Within the rules directory of your copy of the panther-analysis repository, locate the directory for this source, which contains Panther-managed rules and (possibly) scheduled rules.
3.For each Panther-managed rule and scheduled rule that you would like to enable, in the detection's corresponding YAML file, set:
Enabled: True
4.If there are any rules or scheduled rules in the source's directory that you would not like enabled, in the detection's corresponding YAML file, set:
Enabled: False
5.Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.
Go further:
Create additional, custom detections for this source.
Custom logs
If the source is a custom log source:
Create your own detections. See the instructions below for creating detections in the Panther Console and in the CLI workflow. While creating detections:
Consider leveraging Panther-managed helper functions, or creating your own.
Create tests.
Console
CLI
Create rules and scheduled rules in the Console
Create one or more rules for the log source.
​To create a Python rule, follow these instructions.
​To use the Simple Detection builder, follow these instructions.​
If necessary, create one or more Scheduled Rules for the log source by following these instructions.
Create rules and scheduled rules in the CLI workflow
1.If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.
2.Write one or more rules for the log source:
​To write a Python rule, follow these instructions.
​To write a YAML rule, follow these instructions.
3.If necessary, write one or more Scheduled Rules for the log source by following these instructions.
4.Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.
(Optional) Step 2.3: Create or enable policies for each Cloud Security Scanning account
If you onboarded one or more AWS accounts for Cloud Security Scanning, enable Panther-managed policies, or create your own.
Console
CLI
Enable Panther-managed Policies in the Console
Enable the Panther Core AWS Pack in the Panther Console. Note that in addition to Policies, this pack includes rules, helpers, and data models.
​See instructions for enabling Packs in the Console here.
Create Policies in the Console
To create Policies in the Console, follow these instructions.
Enable Panther-managed Policies in the CLI workflow
If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.
Within the policies directory of your copy of the panther-analysis repository, identify the directories of interest to you, i.e., the directories covering AWS resources you are interested in monitoring.
In each directory of interest, for each Panther-managed policy that you would like to enable, set the following in the detection's corresponding YAML file:
Enabled: True
In each directory of interest, if there are any policies in the directory that you would not like enabled, set the following in the detection's corresponding YAML file:
Enabled: False
Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.
Create Policies in the CLI workflow
To write Policies in the CLI workflow, follow these instructions.
​
Detections: Go further
If you are using the CLI workflow, configure your CI/CD pipeline to upload to Panther.
Use Data Replay to check that your detections match when expected.
If you onboarded an AWS account for Cloud Security Scanning, set up real-time monitoring.
Step 3: Configure alert destinations
Set up alert destinations to receive alerts in locations outside of your Panther Console. 
Step 3.1: Identify where you want to receive Panther alerts
Where is the best place for your team to receive Panther alerts? Does it make sense to configure multiple destinations, and route alerts of different severities to different locations?
If you need some ideas to get started, check out the list of supported destinations on the Alert Destinations page. You can also create custom destinations.
Step 3.2: Set up destinations
For each alert destination you'd like to set up:
If the destination is one of the destinations natively supported by Panther, follow the setup instructions specific to that destination.
If the destination is not natively supported by Panther:
If the destination can receive HTTP POST requests containing a JSON payload, follow the instructions to use a Custom Webhook Destination.
Alternatively, consider polling the Panther API for new alerts on a schedule. Learn more about this option here.
Step 3.3: Ensure at least one destination is receiving System Errors
System Errors notify users when some part of their Panther workflow is not functioning correctly, such as log sources turning unhealthy or alerts failing to deliver. Learn more about System Errors on System Health Notifications.
When setting up each alert destination, you'll select the Alert Types sent to that destination, shown below. It's strongly recommended to configure at least one alert destination to receive System Errors.
Alert destinations: Go further
Learn how to triage alerts in Panther on Assigning and Managing Alerts.
Step 4: Learn how to use search tools
Before it's time to investigate a security incident, you'll want to be comfortable using Panther's search tools. 
Practice creating filters and executing a search in the Search tool.
If you are comfortable writing SQL, practice running queries in Data Explorer.
See example queries in Data Explorer Query Examples.
Search: Go further
Create a Scheduled Search, on top of which you can create a Scheduled Rule.
(Optional) Step 5: Set up Enrichment
Panther's Enrichment features can add useful context to log events, enabling you to write higher fidelity detections and generate more informative alerts. These features include:
Panther-managed Enrichment Providers like GreyNoise, IPinfo, Tor Exit Nodes, and Anomali ThreatStream​
​Identity Provider Profiles like Okta Profiles and Google Workspace Profiles​
​Lookup Tables containing custom data
For each of the above features, determine whether you would like to enable them, and if so, follow the set up instructions on their pages.
Quick Start
Data Sources & Transports
Last modified 29d ago