Identity Provider Profiles

Fetch and store user and device data from identity providers

Overview

Panther can retrieve and store user and device data from common identity providers that you've configured as log sources. This information is stored in Panther-managed Lookup Tables, meaning it can be referred to in detection logic and search queries.

Learn more about how to set up profiles for different identity providers on the pages below:

• Okta

• Google Workspace

How to view profile data in the Data Lake

Once a profile has been set up, you can see the data it's storing by querying from its table in the Data Lake.

1. In left-side navigation bar in your Panther Console, click Configure > Enrichment Providers.

2. Locate the Enrichment Provider you'd like to view the data of, and click its name.

3. In the upper-right corner, click View in Data Explorer.

   • You will be redirected to Data Explorer, and a SELECT query will be pre-populated.

4. Below the SQL editor, click Run Query.

   • You can view table data in the Results section, below the SQL editor.