Onboarding Guide

Set up your Panther environment

Overview

Onboarding in Panther means setting up log sources, detections, and alert destinations, as well as familiarizing yourself with search tools and optionally enabling enrichment capabilities. This guide will walk you through each of these tasks.

If you need help while onboarding, feel free to reach out to your Panther support team.

Prerequisite

• You have successfully logged in to your Panther Console.

Step 1: Onboard log sources

The first step in configuring your Panther environment is to onboard log sources, which provide data to Panther to analyze and store. After identifying valuable sources, you'll onboard each one.

Step 1.1: Identify log sources to onboard

Consider the log-emitting systems in your environment that you'd like to monitor for security. It's recommended to onboard enough sources to come close to your allowed ingest volume. You can use log filtering if you would only like to ingest some logs from a certain source into Panther.

If you need some ideas of where to get started, review the Supported Logs list. You can also onboard completely custom sources.

Step 1.2: Onboard each log source

For each of the log sources you've identified as wanting to ingest:

• If the log source is one of Panther's supported sources, onboard it by following the instructions on its documentation page.

• If the log source is not one of Panther's supported sources:

  1. If the source is able to emit event webhooks:

     If the source is high-volume (emits at least one GB per hour) and/or its payload size exceeds the HTTP payload limit, skip to number two.

     1. Onboard the source by following the HTTP Source creation instructions.

     2. Follow the instructions to infer a custom schema from HTTP data received in Panther.

  2. If the source is not able to emit event webhooks but can export events to an S3 bucket:

     1. Onboard the source by following the S3 Source creation instructions.

     2. Follow the instructions to infer a custom schema in one of the following ways:

        • From S3 data received in Panther

        • From historical S3 data

  3. If the source is not able to emit event webhooks nor export events to an S3 bucket, but can export events to one of the other Data Transport locations Panther can pull from, e.g., Google Cloud Storage or Azure Blob Storage:

     1. Define a custom schema in one of the following ways:

        • Inferring from sample logs in the Console

        • Inferring using pantherlog infer

        • Creating one manually in the Console

     2. Onboard the source by following the instructions within the documentation for your chosen Data Transport.

  4. If the source is not able to emit event webhooks nor export events to any of Panther's Data Transport sources, see Panther's Data Pipeline Tools guides or reach out to your Panther support team for assistance in connecting your data to Panther.

These instructions are also represented in the flow chart below:

(Optional) Step 1.3: Onboard AWS account(s) for Cloud Security Scanning

If you use AWS as a cloud provider, you can use Panther's Cloud Security Scanning feature to monitor the configurations of your cloud resources.

• If you'd like to use Cloud Security Scanning, onboard one or more AWS accounts by following these instructions.

Log sources: Go further

• Learn how to monitor the health of your log sources

• Learn about field discovery for custom log sources

• If you created any custom schemas, designate fields as Indicator Fields to enable cross-log search and detections

Step 2: Create or enable detections

Now that your data is flowing into Panther, it's time to configure detections. First, you'll choose whether to manage detection content in the Panther Console or CLI workflow. Then, for each source, you'll enable Panther-managed detections or create your own.

After you have created or enabled detections, alerts for matches will be visible in your Panther Console and queryable via the Panther API—but you will not receive alerts in external applications until you complete the next step, to set up alert destinations.

Step 2.1: Choose the Console or CLI workflow for detection management

Decide whether you'd like to manage detection content in the Panther Console or in the CLI workflow (performing uploads using the Panther Analysis Tool [PAT], perhaps in a CI/CD pipeline). Detection content includes detection packs and detections themselves (rules, scheduled rules, and policies), as well as data models, global helpers, lookup tables, saved queries, and scheduled queries. Managing detection content in both the Console and CLI workflows is unsupported.

You might choose to use the CLI workflow if your team is comfortable using git, command line tools, and CI/CD pipelines. Otherwise, it's recommended to use the Panther Console.

Panther's Simple Detections functionality aims to eventually integrate the Console and CLI workflows. Currently, if your team uses the CLI workflow to manage detection content, the changes made to detections using the Simple Detection builder in the Console will still be overwritten on next upload (except for Inline Filters created in the Console, which will be preserved).

Step 2.2: Create or enable rules and scheduled rules for each log source

For each of the log sources you onboarded to Panther in the previous step, you will enable Panther-managed detections or create your own. If the source is one of Panther's Supported Logs, follow the Supported logs section below. Otherwise, follow the Custom logs section.

Supported logs

• If the source is one of Panther's Supported Logs:

  • Enable a Panther-managed Detection Pack for the source. See the instructions below for enabling a Detection Pack in the Panther Console and in the CLI workflow.

  • If you already enabled a Detection Pack for this log source during onboarding (on the final "Success!" page), move on to the next log source.

Console

Enable a Panther-managed Detection Pack in the Console

• Follow these instructions to enable a Panther-managed Detection Pack for the source.

Go further:

• Learn how to customize a Panther-managed detection.

• Create additional, custom detections for this source.

CLI

Enable a Panther-managed Detection Pack in the CLI workflow

1. If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of detections.

2. Within the rules directory of your copy of the panther-analysis repository, locate the directory for this source, which contains Panther-managed rules and (possibly) scheduled rules.

3. For each Panther-managed rule and scheduled rule that you would like to enable, in the detection's corresponding YAML file, set:

   Enabled: True

4. If there are any rules or scheduled rules in the source's directory that you would not like enabled, in the detection's corresponding YAML file, set:

   Enabled: False

5. Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.

Go further:

• Create additional, custom detections for this source.

Custom logs

• If the source is a custom log source:

  • Create your own detections. See the instructions below for creating detections in the Panther Console and in the CLI workflow. While creating detections:

    • Consider leveraging Panther-managed helper functions, or creating your own.

    • Create tests.

Console

Create rules and scheduled rules in the Console

• Create one or more rules for the log source.

  • To create a Python rule, follow these instructions.

  • To use the Simple Detection builder, follow these instructions.

• If necessary, create one or more Scheduled Rules for the log source by following these instructions.

CLI

Create rules and scheduled rules in the CLI workflow

1. If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.

2. Write one or more rules for the log source:

   • To write a Python rule, follow these instructions.

   • To write a Simple Detection rule, follow these instructions.

3. If necessary, write one or more Scheduled Rules for the log source by following these instructions.

4. Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.

(Optional) Step 2.3: Create or enable policies for each Cloud Security Scanning account

If you onboarded one or more AWS accounts for Cloud Security Scanning, enable Panther-managed policies, or create your own.

Console

Enable Panther-managed Policies in the Console

• Enable the Panther Core AWS Pack in the Panther Console. Note that in addition to Policies, this pack includes rules, helpers, and data models.

  • See instructions for enabling Packs in the Console here.

Create Policies in the Console

• To create Policies in the Console, follow these instructions.

CLI

Enable Panther-managed Policies in the CLI workflow

• If you have not done so already, follow these instructions to clone or fork the panther-analysis repository of Python detections.

• Within the policies directory of your copy of the panther-analysis repository, identify the directories of interest to you, i.e., the directories covering AWS resources you are interested in monitoring.

• In each directory of interest, for each Panther-managed policy that you would like to enable, set the following in the detection's corresponding YAML file:

  Enabled: True

• In each directory of interest, if there are any policies in the directory that you would not like enabled, set the following in the detection's corresponding YAML file:

  Enabled: False

• Upload your detections to Panther manually using PAT, or configure your CI/CD pipeline to upload detection content with PAT.

Create Policies in the CLI workflow

• To write Policies in the CLI workflow, follow these instructions.

Detections: Go further

• If you are using the CLI workflow, configure your CI/CD pipeline to upload to Panther.

• Use Data Replay to check that your detections match when expected.

• If you onboarded an AWS account for Cloud Security Scanning, set up real-time monitoring.

Step 3: Configure alert destinations

Set up alert destinations to receive alerts in locations outside of your Panther Console.

Step 3.1: Identify where you want to receive Panther alerts

Where is the best place for your team to receive Panther alerts? Does it make sense to configure multiple destinations, and route alerts of different severities to different locations?

If you need some ideas to get started, check out the list of supported destinations on the Alert Destinations page. You can also create custom destinations.

Step 3.2: Set up destinations

For each alert destination you'd like to set up:

• If the destination is one of the destinations natively supported by Panther, follow the setup instructions specific to that destination.

• If the destination is not natively supported by Panther:

  • If the destination can receive HTTP POST requests containing a JSON payload, follow the instructions to use a Custom Webhook Destination.

  • Alternatively, consider polling the Panther API for new alerts on a schedule. Learn more about this option here.

Step 3.3: Ensure at least one destination is receiving System Errors

System Errors notify users when some part of their Panther workflow is not functioning correctly, such as log sources turning unhealthy or alerts failing to deliver. Learn more about System Errors on System Health Notifications.

When setting up each alert destination, you'll select the Alert Types sent to that destination, shown below. It's strongly recommended to configure at least one alert destination to receive System Errors.

Alert destinations: Go further

• Learn how to triage alerts in Panther on Assigning and Managing Alerts.

Step 4: Learn how to use search tools

Before it's time to investigate a security incident, you'll want to be comfortable using Panther's search tools.

• Practice creating filters and executing a search in the Search tool.

• If you are comfortable writing SQL, practice running queries in Data Explorer.

  • See example queries in Data Explorer Query Examples.

Search: Go further

• Create a Scheduled Search, on top of which you can create a Scheduled Rule.

(Optional) Step 5: Set up Enrichment

Panther's Enrichment features can add useful context to log events, enabling you to write higher fidelity detections and generate more informative alerts. These features include:

• Panther-managed Enrichment Providers like GreyNoise, IPinfo, Tor Exit Nodes, and Anomali ThreatStream

• Identity Provider Profiles like Okta Profiles and Google Workspace Profiles

• Lookup Tables containing custom data

For each of the above features, determine whether you would like to enable them, and if so, follow the set up instructions on their pages.