> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/system-configuration.md).
# System Configuration
## Overview
Use Panther's system configuration settings to configure your Panther Console and overall Panther deployment to best meet your organization's needs.
To access your settings, click the gear icon in the upper-right corner of your Panther Console. Settings open in a dedicated area with a left-hand navigation menu. To quickly find a setting, use the **Search Settings** field at the top of the menu.
The navigation menu groups settings into the following sections:
* **General Settings**:
* [Main Info & Preferences](#main-info-and-preferences)
* [Theme](#theme)
* [AI Preferences](#ai-preferences)
* **Access & Authentication**:
* [Password Management](#password-management)
* [Identity & Access](#identity-and-access)
* [User Management](#user-management)
* [Roles & Permissions](#roles-and-permissions)
* **Data Lake**:
* [Data Lake Configuration](#data-lake-configuration)
* [Scheduled Searches](#scheduled-searches)
* **Developer Tools**:
* [API Tokens](#api-tokens)
* [API Playground](#api-playground)
* [Git Sync](#git-sync)
* [Panther Analysis Tool](#panther-analysis-tool)
* **AI & Automation**:
* [Usage](#usage)
* [Configuration](#configuration)
* [Web Access](#web-access)
* [Remote MCP](#remote-mcp)
* [MCP Servers](#mcp-servers)
* **Alert Configuration**:
* [Alert Context Tags](#alert-context-tags)
* **About**:
* [Open Source Licenses](#open-source-licenses)
Only users with the `Read Settings & SAML Preferences` permission can view these configurations, and only those with `Edit Settings & SAML Preferences` can make changes.
## General Settings
### Main Info & Preferences
The **Main Info & Preferences** page contains your account information, organization details, and platform preferences. It includes the following:
* **Account Information**: View your **Email** and set your **First Name** and **Last Name**.
* **Company Information**:
* **Company Name**
* **Email**
* **Preferences**:
* **Send Product Analytics**: Send anonymized product analytics to help us improve Panther. To learn more, see [Security and Privacy](/resources/help/security-privacy.md#privacy).
* **Enable Panther Audit Logs**: Enable audit logs. If enabled, a new Panther-managed log source appears on the **Log Sources** page. This can only be enabled by users with the `Edit Settings & SAML Preferences` permission.
* Panther audit logs provide a read-only history of activity in your Panther deployment. You can write detections on your audit logs, or query for them in your [data lake](/resources/help/glossary.md#security-data-lake), the same way you would with any other security events ingested by Panther. For more information, see [Panther Audit Logs](/data-onboarding/supported-logs/panther-audit-logs.md).
* **Display UTC Time Zone**: Display time zones in UTC. When switched off, time and date are shown in local time.
* **Receive Alert Assignment Emails**: Receive an email whenever an alert is assigned to you. This setting does not control your [in-Console notification](/system-configuration/notifications.md) preferences.
#### Infrastructure
The **Infrastructure** section displays your Panther instance's **AWS Account ID**, **AWS Region**, **Version**, and **Gateway Public IP**. Click the copy icon next to a value to copy it.
### Theme
On the **Theme** page, choose how the Panther Console looks for you: **System**, **Light**, or **Dark**.
### AI Preferences
On the **AI Preferences** page, you can customize how Panther AI communicates with you by setting a personal AI prompt. This allows you to specify your preferred communication style, role, expertise level, or other preferences that will be applied to all AI interactions.
{% hint style="info" %}
Changes to AI preferences may take up to 10 minutes to take effect. For more information about AI preferences, see [Personal AI preferences](/ai.md#personal-ai-preferences).
{% endhint %}
## Access & Authentication
### Password Management
On the **Password Management** page, you can manage your password. If you signed in using SSO, the fields on this page are disabled.
Panther requires a strong password:
* Password must contain at least 1 number
* Password must contain at least 1 symbol
* Password must contain at least 1 lowercase character
* Password must contain at least 1 uppercase character
* Password must contain at least 12 characters
### Identity & Access
You can integrate with SAML Identity Providers (IdPs) to enable user login to the Panther Console via [SSO](/resources/help/glossary.md#sso-single-sign-on). After setting up a SSO integration, you can optionally [enforce its use](/system-configuration/saml.md#how-to-enforce-sso) for logging in. Panther integrates with the following providers:
* [Duo](/system-configuration/saml/duo-sso.md)
* [G Suite](/system-configuration/saml/gsuite.md)
* [Okta](/system-configuration/saml/okta.md)
* [OneLogin](/system-configuration/saml/onelogin.md)
Panther also supports integrating with *any* SAML IdP via the [Generic SSO](/system-configuration/saml/generic.md) integration.
For more information, see [SAML/SSO Integration](/system-configuration/saml.md).
### User Management
Under **Access & Authentication** > **User Management**, users with the **View Users** permission can view a list of all users in your Panther account. A user with the **Manage Users** permission can delete and invite users.
#### Viewing the Users list
The **User Management** page displays a searchable, sortable list of Panther users—including each user's name, email, role, status, and the dates/times at which they were invited to Panther and last logged in. You can filter users by role and status, and sort by any column.
The **Status** column can have the following values:
* **Confirmed**: user has been set up with password authentication and has changed their initial temporary password.
* **Force Change Password**: user must change password upon next sign-in.
* This usually appears for newly created users; it appears between user creation and first sign-in.
* **External Provider**: user is managed via SSO through an [external SAML provider](/system-configuration/saml.md).
#### Inviting a user to Panther
To invite a new user to Panther:
1. In the upper-right corner of your Panther Console, click the gear icon to open Settings, then navigate to **Access & Authentication** > **User Management**.
2. Click **Invite User**.
3. Fill in the form, providing the user's email address, first name, last name, and role.
4. Click **Invite**.
* If the invitation is sent successfully, you will see a pop-up:
* The invited user must follow the flow outlined in [Initial login](#initial-login), below.
#### Initial login
When you invite a new user to your Panther instance, they receive an email with temporary credentials that they can use to sign in to the platform.
After a user's initial login, they are required to update their password and set up MFA. Passwords must meet Panther's [strong password requirements](#password-management).
### Roles & Permissions
Under **Access & Authentication** > **Roles & Permissions**, you can configure [Role-Based Access Control (RBAC)](/resources/help/glossary.md#rbac-role-based-access-control). This gives Panther deployments granular access control for its user accounts. All roles, including the three [default Panther roles](/system-configuration/rbac.md#default-panther-roles), are customizable by any user with `UserModify` permissions.
For more information, see [Role-Based Access Control](/system-configuration/rbac.md).
## Data Lake
### Data Lake Configuration
The **Data Lake Configuration** page includes information about your data lake.
It also includes the ability to make LIMIT clauses required for scheduled queries. See the [scheduled query documentation](/search/scheduled-searches.md#use-limits-in-scheduled-queries) for more information.
### Scheduled Searches
The **Scheduled Searches** page lists the [scheduled searches](/search/scheduled-searches.md) configured in your Panther instance.
## Developer Tools
### API Tokens
Under **Developer Tools** > **API Tokens**, view a list of API tokens that have been created for your account. You can also [create a new API Token](/panther-developer-workflows/api.md#step-1-creating-an-api-token).
### API Playground
Under **Developer Tools** > **API Playground**, access [Panther's API Playground](/panther-developer-workflows/api/api-playground.md) to try out API operations.
### Git Sync
{% hint style="warning" %}
Git Sync is in open beta starting with Panther version 1.125. Please share any bug reports and feature requests with your Panther support team.
{% endhint %}
Panther supports syncing detection changes from the Panther Console to your GitHub repository via the Panther GitHub App. To set this up, configure your repository in the **Git Sync** tile on this page, then install the Panther GitHub App on that repository. See [Setting Up the Panther GitHub App](/panther-developer-workflows/detections-repo/github-app.md) for full instructions.
Once configured, eligible Console edits produce pull requests in your GitHub repository instead of saving directly to Panther. Learn more in [Creating a GitHub pull request from the Panther Console](/panther-developer-workflows/overview.md#creating-a-github-pull-request-from-the-panther-console).
### Panther Analysis Tool
Click the toggle next to **We use the Panther Analysis Tool to manage our detections** if you want to prevent users from enabling Panther Packs in the Panther Console. This helps prevent update conflicts between the Console and CI/CD workflows.
This workflow is also known as the CLI workflow.
## AI & Automation
To access your Panther AI settings, click the gear icon to open Settings, then select a page under **AI & Automation**.
### Usage
The **Usage** page provides a dashboard to view your Panther AI usage for the current term and analyze usage trends. For more information, see [AI Usage Dashboard](/ai/using-panther-ai/ai-usage-dashboard.md).
### Configuration
The following settings are available:
* **Enable Panther AI**: Must be set to `ON` to use Panther AI. It can only be enabled by users with the `Edit Settings & SAML Preferences` permission. Additional steps may be required to use Panther AI—see [Enabling Panther AI](/ai.md#enabling-panther-ai).
* **Organization Profile**: Add an optional static prompt to all AI analyses. You can provide organization-specific context and direction in the text box to enhance AI-powered threat analysis.
* **Auto-resolve Based on Risk Score**: When set to `ON`, Panther AI automatically resolves alerts that receive a risk classification score at or below a configured threshold. This allows low-risk alerts to be closed without manual intervention. Learn more in [Auto-resolve alerts based on risk score](/ai/using-panther-ai/panther-ai-and-alerts.md#auto-resolve-alerts-based-on-risk-score).
* **Risk score Threshold**: Set the maximum risk score at which alerts are auto-resolved. The threshold is a value on a scale from -1 (most benign) to +1 (most risky). Only alerts with a risk score at or below this threshold are auto-resolved.
* **Alert Severities** (Optional): If one or more alert severities are selected, only alerts with those severities are eligible for auto-resolve. The `INFO` severity is excluded from this list.
* **Detection Tags** (Optional): If one or more tags is entered, only alerts triggered by detections with at least one of those tags are eligible for auto-resolve.
* Auto-resolve requires **Auto-run AI Triage on Alerts** to be enabled, since alerts must first be triaged by Panther AI to receive a risk score.
* **Auto-run AI Triage on Alerts**: When set to `ON`, AI alert triage runs automatically on new alerts. Learn more in [Auto-run AI alert triage](/alerts.md#auto-run-ai-alert-triage).
* **Alert Severities**: If one or more alert severities is selected, Panther AI will only auto-run alert triage for alerts with those severities. Note that the `INFO` severity is excluded from this list, as Panther does not allow auto-run AI triage on `INFO`-level alerts.
* **Detection Tags**: If one or more tags is entered, Panther AI will only auto-run alert triage for alerts triggered by detections with at least one of those tags.
{% hint style="info" %}
**Important notes about auto-run AI triage**
* Auto-run AI triage is only available to [Cloud Connected](/system-configuration/panther-deployment-types/cloud-connected.md) customers and [SaaS](/system-configuration/panther-deployment-types/saas.md) customers with pass-through billing.
* If both the **Alert Severities** and **Detection Tags** fields contain values, AI triage will only be auto-run if an alert meets both criteria, i.e., has one of the specified severities *and* its associated detection has one of the specified tags.
{% endhint %}
### Web Access
The **Web Access** page controls whether Panther AI can fetch content from external web pages and process file attachments during conversations. When enabled, Panther AI can read web pages, images, and PDF documents to add context during analysis — for example, referencing public documentation, threat intelligence reports, or indicators of compromise. This setting also enables [file attachments](/ai.md#file-attachments), allowing users to upload files directly to AI conversations.
The following settings are available:
* **Enable Web Access**: Controls whether Panther AI can fetch web content and process file attachments. When set to `OFF`, both web content fetching and file attachment capabilities are disabled entirely.
* **Approved Domains**: A list of domains that Panther AI can access without requiring user approval. Wildcard entries are supported — for example, `*.example.com` matches any subdomain of `example.com` (such as `docs.example.com`) but does not match `example.com` itself.
* **Forbidden Domains**: A list of domains that Panther AI is never allowed to access, regardless of other settings. Wildcard entries are supported. Forbidden domains take priority over approved domains.
* **Require Approval for Non-Approved Domains**: When set to `ON`, Panther AI will pause and ask for your approval before fetching content from a domain that is not on the approved domains list. When set to `OFF`, Panther AI can only access domains on the approved list.
{% hint style="info" %}
When **Require Approval for Non-Approved Domains** is `OFF` and the approved domains list is empty, Panther AI cannot access any web content. When **Require Approval for Non-Approved Domains** is `ON` and the approved domains list is empty, every web request triggers a user approval prompt.
{% endhint %}
**Security considerations:**
* Panther AI will never make requests to private or internal network addresses (e.g., `10.0.0.0/8`, `169.254.169.254`, `localhost`), regardless of domain settings.
* If an approved domain redirects to a forbidden or non-approved domain, the request is blocked.
* All web access requests are recorded in Panther audit logs, including the requested URL.
### Remote MCP
The **Remote MCP** page controls the **Remote MCP Client Allowlist**, which restricts the OAuth redirect destinations that remote MCP clients (such as Claude Desktop or Cursor) may use when authorizing with Panther. You can configure **Allowed Redirect Hosts** and **Allowed Custom Schemes**. Loopback HTTP redirects (`localhost`, `127.0.0.1`, `::1`) are always permitted and do not need to be listed.
For more information, see [Panther Remote MCP](/ai/mcp/panther-remote-mcp.md).
### MCP Servers
On the **MCP Servers** page, you can connect and manage external MCP server integrations that Panther AI uses. For more information, see [MCP Integrations](/ai/mcp/mcp-integrations.md).
## Alert Configuration
### Alert Context Tags
Under **Alert Configuration** > **Alert Context Tags**, you can view a list of alert context tags and add new tags.
For more information, see [Custom alert context tags](/alerts/alert-management.md#custom-alert-context-tags).
## About
### Open Source Licenses
The **Open Source Licenses** page lists the open source software licenses used by Panther.
## Other Panther Console features
### System Health Notifications
Panther's System Health Notifications alert you with a "System Error" when a part of the Panther platform is not functioning correctly. This includes the following types of notifications:
* Log source health notifications
* Log classification errors
* Alert delivery failures
* Cloud security scanning failures
For more information, see [System Health Notifications.](/system-configuration/notifications/system-errors.md)
## Troubleshooting System Configuration
Visit the Panther Knowledge Base to [view articles about system configuration](https://help.panther.com/System_Configuration) that answer frequently asked questions and help you resolve common errors and issues.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.panther.com/system-configuration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.