Operations
Assessing Data Ingest Volume
You can use the Panther API metrics operations to measure the total number of bytes and events that Panther ingested or processed over a specific time period. For other methods of assessing data ingestion volume, see the sections below.
SaaS deployments of Panther
Please reach out to your Panther account team for help accessing this data.
Self-Hosted and CPaaS deployment of Panther
The information below applies to Self-Hosted and CPaaS deployment types.
The Panther log analysis CloudWatch dashboard provides deep insight into operationally relevant aspects of log processing. Understanding the ingest volume is critically important to forecast the cost of running Panther.
In the Dashboard of your Panther Console, you can view the volume of logs ingested. This can be used, in combination with your AWS bill, to forecast costs as you scale your data. We suggest you use a month of data to estimate your costs.
To view the CloudWatch dashboard:
Log in to the AWS Console.
Click CloudWatch from the Services menu.
Set the time period for 4 weeks, then click Apply.
At the top of the Logs Insights page, click Run Query.
Operational Tools
Panther comes with some operational tools useful for managing Panther infrastructure. These tools are statically compiled executables for Linux, Mac (including Darwin) and Windows.
These tools require that AWS credentials be set in the environment with sufficient privileges. We recommend a tool to manage these securely such as AWS Vault.
Do not run any of these tools unless specifically advised by a Panther team member.
Expand the tools below to find download links for the latest versions. Running these commands with the -h
flag will explain usage.
For information on using Panther's development tools, see the following pages:
How to download a specific version of Panther's tools
If you want to download the latest version of a tool, use the download links within the tool's respective section, above. If you'd like to download a specific version of a tool, follow the instructions below.
Instructions for downloading the tools differs depending on your Panther version.
Step 1: Confirm your Panther version
Log in to the Panther Console.
Step 2: Find your download link format
Panther v1.27+
To download a specific version of a tool, construct the S3 download URL manually, using the following format:
https://panther-community-us-east-1.s3.amazonaws.com/{version}/tools/{os}-{arch}-{tool}.zip
Replace the placeholder text in the download URL as described below:
version:
The version of Panther you have deployed, e.g.v1.27.0
latest
can replaceversion
to download the latest version of the tool.
os
: Use one of the following:darwin
,linux
, orwindows
arch
: Useamd64
orarm64
tool
: The name of the tool you are downloading. See Tool for a list of available tools.
Example complete tool link using {version}
https://panther-community-us-east-1.s3.amazonaws.com/v1.27.0/tools/darwin-amd64-compact.zip
Example download link using latest
https://panther-community-us-east-1.s3.amazonaws.com/latest/tools/darwin-amd64-compact.zip
Monitoring
The information below applies to legacy Self-Hosted and CPaaS deployment types. Panther no longer supports these deployment types for new accounts.
Visibility
Panther has 5 CloudWatch dashboards to provide visibility into the operation of the system:
PantherOverview An overview of all errors and performance of all Panther components.
PantherCloudSecurity: Details of the components monitoring infrastructure for CloudSecurity.
PantherAlertProcessing: Details of the components that relay alerts for CloudSecurity and Log Processing.
PantherLogAnalysis: Details of the components processing logs and running rules.
PantherRemediation: Details of the components that remediate infrastructure issues.
Alarms
Panther uses CloudWatch Alarms to monitor the health of each component. Edit the deployments/panther_config.yml
file to associate an SNS topic you have created with the Panther CloudWatch alarms to receive notifications. If this value is blank then Panther will associate alarms with the default Panther SNS topic called panther-alarms
:
To configure alarms to send to your team, follow the guides below:
Note: Pager Duty cannot handle composite CloudWatch alarms, which Panther uses to avoid duplicate pages to oncall staff. As a workaround, you can use a
Custom Event Transformer
.Follow the instructions using the below code:
Configure the SNS topic to use
RawMessageDelivery: true
when creating the Pager Duty subscription.
Last updated