Onboarding Guide
Set up your Panther environment
Onboarding in Panther means setting up log sources, detections, and alert destinations, as well as familiarizing yourself with search tools and optionally enabling enrichment capabilities. This guide will walk you through each of these tasks.
If you need help while onboarding, feel free to reach out to your Panther support team.
- You have successfully logged in to your Panther Console.
The first step in configuring your Panther environment is to onboard log sources, which provide data to Panther to analyze and store. After identifying valuable sources, you'll onboard each one.
Consider the log-emitting systems in your environment that you'd like to monitor for security. It's recommended to onboard enough sources to come close to your allowed ingest volume. You can use log filtering if you would only like to ingest some logs from a certain source into Panther.
If you need some ideas of where to get started, review the Supported Logs list. You can also onboard completely custom sources.
For each of the log sources you've identified as wanting to ingest:
- If the log source is one of Panther's supported sources, onboard it by following the instructions on its documentation page.
- 1.If the source is able to emit event webhooks:If the source is high-volume (emits at least one GB per hour) and/or its payload size exceeds the HTTP payload limit, skip to number two.
- 1.
- 2.If the source is not able to emit event webhooks but can export events to an S3 bucket:
- 1.
- 2.Follow the instructions to infer a custom schema in one of the following ways:
- 3.If the source is not able to emit event webhooks nor export events to an S3 bucket, but can export events to one of the other Data Transport locations Panther can pull from, e.g., Google Cloud Storage or Azure Blob Storage:
- 1.Define a custom schema in one of the following ways:
- 2.Onboard the source by following the instructions within the documentation for your chosen Data Transport.
- 4.If the source is not able to emit event webhooks nor export events to any of Panther's Data Transport sources, see Panther's Data Pipeline Tools guides or reach out to your Panther support team for assistance in connecting your data to Panther.
These instructions are also represented in the flow chart below:

If you use AWS as a cloud provider, you can use Panther's Cloud Security Scanning feature to monitor the configurations of your cloud resources.
- If you'd like to use Cloud Security Scanning, onboard one or more AWS accounts by following these instructions.
- If you created any custom schemas, designate fields as Indicator Fields to enable cross-log search and detections
Now that your data is flowing into Panther, it's time to configure detections. First, you'll choose whether to manage detection content in the Panther Console or CLI workflow. Then, for each source, you'll enable Panther-managed detections or create your own.
After you have created or enabled detections, alerts for matches will be visible in your Panther Console and queryable via the Panther API—but you will not receive alerts in external applications until you complete the next step, to set up alert destinations.
Decide whether you'd like to manage detection content in the Panther Console or in the CLI workflow (performing uploads using the Panther Analysis Tool [PAT], perhaps in a CI/CD pipeline). Detection content includes detection packs and detections themselves (rules, scheduled rules, and policies), as well as data models, global helpers, lookup tables, saved queries, and scheduled queries. Managing detection content in both the Console and CLI workflows is unsupported.
You might choose to use the CLI workflow if your team is comfortable using git, command line tools, and CI/CD pipelines. Otherwise, it's recommended to use the Panther Console.
Panther's Simple Detections functionality aims to eventually integrate the Console and CLI workflows. Currently, if your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will still be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).
For each of the log sources you onboarded to Panther in the previous step, you will enable Panther-managed detections or create your own. If the source is one of Panther's Supported Logs, follow the Supported logs section below. Otherwise, follow the Custom logs section.
- Enable a Panther-managed Detection Pack for the source. See the instructions below for enabling a Detection Pack in the Panther Console and in the CLI workflow.
- If you already enabled a Detection Pack for this log source during onboarding (on the final "Success!" page), move on to the next log source.
Console
CLI
Go further:
- Create additional, custom detections for this source.
- 1.If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.
- 2.Within the rules directory of your copy of the panther-analysis repository, locate the directory for this source, which contains Panther-managed rules and (possibly) scheduled rules.
- 3.For each Panther-managed rule and scheduled rule that you would like to enable, in the detection's corresponding YAML file, set:Enabled: True
- 4.If there are any rules or scheduled rules in the source's directory that you would not like enabled, in the detection's corresponding YAML file, set:Enabled: False
- 5.Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.
Go further:
- Create additional, custom detections for this source.
- If the source is a custom log source:
- Create your own detections. See the instructions below for creating detections in the Panther Console and in the CLI workflow. While creating detections:
Console
CLI
- Create one or more rules for the log source.
- If necessary, create one or more Scheduled Rules for the log source by following these instructions.
- 1.If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.
- 2.Write one or more rules for the log source:
- 3.
- 4.Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.
If you onboarded one or more AWS accounts for Cloud Security Scanning, enable Panther-managed policies, or create your own.
Console
CLI
- Enable the Panther Core AWS Pack in the Panther Console. Note that in addition to Policies, this pack includes rules, helpers, and data models.
- If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.
- Within the policies directory of your copy of the panther-analysis repository, identify the directories of interest to you, i.e., the directories covering AWS resources you are interested in monitoring.
- In each directory of interest, for each Panther-managed policy that you would like to enable, set the following in the detection's corresponding YAML file:Enabled: True
- In each directory of interest, if there are any policies in the directory that you would not like enabled, set the following in the detection's corresponding YAML file:Enabled: False
- Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.
Set up alert destinations to receive alerts in locations outside of your Panther Console.
Where is the best place for your team to receive Panther alerts? Does it make sense to configure multiple destinations, and route alerts of different severities to different locations?
If you need some ideas to get started, check out the list of supported destinations on the Alert Destinations page. You can also create custom destinations.
For each alert destination you'd like to set up:
- If the destination is one of the destinations natively supported by Panther, follow the setup instructions specific to that destination.
- If the destination is not natively supported by Panther:
- If the destination can receive HTTP
POST
requests containing aJSON
payload, follow the instructions to use a Custom Webhook Destination. - Alternatively, consider polling the Panther API for new alerts on a schedule. Learn more about this option here.
System Errors notify users when some part of their Panther workflow is not functioning correctly, such as log sources turning unhealthy or alerts failing to deliver. Learn more about System Errors on System Health Notifications.
When setting up each alert destination, you'll select the Alert Types sent to that destination, shown below. It's strongly recommended to configure at least one alert destination to receive System Errors.

Before it's time to investigate a security incident, you'll want to be comfortable using Panther's search tools.
Panther's Enrichment features can add useful context to log events, enabling you to write higher fidelity detections and generate more informative alerts. These features include:
- Panther-managed Enrichment Providers like GreyNoise, IPinfo, Tor Exit Nodes, and Anomali ThreatStream
For each of the above features, determine whether you would like to enable them, and if so, follow the set up instructions on their pages.
Last modified 29d ago