Onboarding Guide

Set up your Panther environment


Onboarding in Panther means setting up log sources, detections, and alert destinations, as well as familiarizing yourself with search tools and optionally enabling enrichment capabilities. This guide will walk you through each of these tasks.

If you need help while onboarding, feel free to reach out to your Panther support team.


  • You have successfully logged in to your Panther Console.

Step 1: Onboard log sources

The first step in configuring your Panther environment is to onboard log sources, which provide data to Panther to analyze and store. After identifying valuable sources, you'll onboard each one.

Step 1.1: Identify log sources to onboard

Consider the log-emitting systems in your environment that you'd like to monitor for security. It's recommended to onboard enough sources to come close to your allowed ingest volume. You can use log filtering if you would only like to ingest some logs from a certain source into Panther.

If you need some ideas of where to get started, review the Supported Logs list. You can also onboard completely custom sources.

Step 1.2: Onboard each log source

For each of the log sources you've identified as wanting to ingest:

These instructions are also represented in the flow chart below:

(Optional) Step 1.3: Onboard AWS account(s) for Cloud Security Scanning

If you use AWS as a cloud provider, you can use Panther's Cloud Security Scanning feature to monitor the configurations of your cloud resources.

Log sources: Go further

Step 2: Create or enable detections

Now that your data is flowing into Panther, it's time to configure detections. First, you'll choose whether to manage detection content in the Panther Console or CLI workflow. Then, for each source, you'll enable Panther-managed detections or create your own.

After you have created or enabled detections, alerts for matches will be visible in your Panther Console and queryable via the Panther API—but you will not receive alerts in external applications until you complete the next step, to set up alert destinations.

Step 2.1: Choose the Console or CLI workflow for detection management

Decide whether you'd like to manage detection content in the Panther Console or in the CLI workflow (performing uploads using the Panther Analysis Tool [PAT], perhaps in a CI/CD pipeline). Detection content includes detection packs and detections themselves (rules, scheduled rules, and policies), as well as data models, global helpers, lookup tables, saved queries, and scheduled queries. Managing detection content in both the Console and CLI workflows is unsupported.

You might choose to use the CLI workflow if your team is comfortable using git, command line tools, and CI/CD pipelines. Otherwise, it's recommended to use the Panther Console.

Panther's Simple Detections functionality aims to eventually integrate the Console and CLI workflows. Currently, if your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will still be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).

Step 2.2: Create or enable rules and scheduled rules for each log source

For each of the log sources you onboarded to Panther in the previous step, you will enable Panther-managed detections or create your own. If the source is one of Panther's Supported Logs, follow the Supported logs section below. Otherwise, follow the Custom logs section.

Supported logs

  • If the source is one of Panther's Supported Logs:

    • Enable a Panther-managed Detection Pack for the source. See the instructions below for enabling a Detection Pack in the Panther Console and in the CLI workflow.

    • If you already enabled a Detection Pack for this log source during onboarding (on the final "Success!" page), move on to the next log source.

Enable a Panther-managed Detection Pack in the Console

Go further:

Custom logs

  • If the source is a custom log source:

    • Create your own detections. See the instructions below for creating detections in the Panther Console and in the CLI workflow. While creating detections:

Create rules and scheduled rules in the Console

(Optional) Step 2.3: Create or enable policies for each Cloud Security Scanning account

If you onboarded one or more AWS accounts for Cloud Security Scanning, enable Panther-managed policies, or create your own.

Enable Panther-managed Policies in the Console

Create Policies in the Console

Detections: Go further

Step 3: Configure alert destinations

Set up alert destinations to receive alerts in locations outside of your Panther Console.

Step 3.1: Identify where you want to receive Panther alerts

Where is the best place for your team to receive Panther alerts? Does it make sense to configure multiple destinations, and route alerts of different severities to different locations?

If you need some ideas to get started, check out the list of supported destinations on the Alert Destinations page. You can also create custom destinations.

Step 3.2: Set up destinations

For each alert destination you'd like to set up:

Step 3.3: Ensure at least one destination is receiving System Errors

System Errors notify users when some part of their Panther workflow is not functioning correctly, such as log sources turning unhealthy or alerts failing to deliver. Learn more about System Errors on System Health Notifications.

When setting up each alert destination, you'll select the Alert Types sent to that destination, shown below. It's strongly recommended to configure at least one alert destination to receive System Errors.

Alert destinations: Go further

Step 4: Learn how to use search tools

Before it's time to investigate a security incident, you'll want to be comfortable using Panther's search tools.

Search: Go further

(Optional) Step 5: Set up Enrichment

Panther's Enrichment features can add useful context to log events, enabling you to write higher fidelity detections and generate more informative alerts. These features include:

For each of the above features, determine whether you would like to enable them, and if so, follow the set up instructions on their pages.

Last updated