Saved and Scheduled Queries

Overview

You can avoid repeatedly creating the same queries in Panther's Data Explorer and Query Builder by saving your queries. You can also schedule queries created in Data Explorer, which allows you to then run results against a rule and alert on matches. This workflow includes the following features:

• Create a Saved Query, a preserved SQL expression.

• Create a Scheduled Query, a Saved Query that you can schedule to run on a designated interval.

• Create a Scheduled Rule, a detection that's associated with a Scheduled Query. The data returned each time the query executes is run against the detection, alerting when matches are found.

By default, each Panther account is limited to 10 active Scheduled Queries. This limit is only precautionary, and can be increased via a support request. There is no additional cost from Panther for raising this limit, however you may incur extra charges from the database backend, depending on the volume of data processed.

How to create a Saved Query

A Saved Query is a preserved data query. Saving the queries your team runs frequently can help reduce duplicated work. You can create Saved Queries in the Panther Console (in either Query Builder or Data Explorer), or using the developer workflow.

AnalysisType: saved_query
QueryName: MySavedQuery
Description: Example of a saved query for PAT
Query: |-
    Your query goes here
Tags:
  - Your tags

How to create a Scheduled Query

A Scheduled Query is a Saved Query that has been configured to run on a schedule. Using the Panther Console, currently only Saved Queries created in Data Explorer can be scheduled—Saved Queries created in Query Builder cannot be scheduled. You can alternatively create and upload Scheduled Queries using the developer workflow. Scheduled Queries created in the developer workflow can use session variables to create dynamic timeframes.

Remember that creating a Scheduled Query alone won't run the returned data against detections or send alerts. To do this, also create a Scheduled Rule, and associate it with your Scheduled Query.

AnalysisType: scheduled_query
QueryName: ScheduledQuery_Example
Description: Example of a scheduled query for PAT
Enabled: true
Query: |-
    Select 1
Tags:
  - Your tags   
Schedule:
  CronExpression: "0 0 29 2 *"
  RateMinutes: 0
  TimeoutMinutes: 2

How to use the Scheduled Query crontab

Panther's Scheduled Query crontab uses the standard crontab notation consisting of five fields: minutes, hours, day of month, month, day of week. Additionally, you will find a query timeout selector (with a maximum value currently set at 10 minutes). The expression will run on UTC.

The interpreter uses a subset of the standard crontab notation:

┌───────── minute (0 - 59)
│ ┌──────── hour (0 - 23)
│ │ ┌────── day of month (1 - 31)
│ │ │ ┌──── month (1 - 12)
│ │ │ │ ┌── day of week (0 - 6 => Sunday - Saturday)
│ │ │ │ │               
↓ ↓ ↓ ↓ ↓
* * * * *

If you want to specify day by day, you can separate days with dashes (1-5 is Monday through Friday) or commas, for example 0,1,4 in the Day of Week field will execute the command only on Sundays, Mondays and Thursdays. Currently, we do not support using named days of the week or month names.

Using the crontab allows you to be more specific in your schedule than the Period frequency option:

How to use session variables in Scheduled Queries

When creating a Scheduled Query in the developer workflow (i.e., writing it locally, then uploading it using the Panther Analysis Tool), you can use session variables to create dynamic start and end times in your SQL query. Note that it is not possible to use session variables when creating a Scheduled Query in the Panther Console.

In the Scheduled Query YAML file, include the Lookback and LookbackWindowSeconds keys. To use session variables, Lookback must be set to true, and LookbackWindowSeconds given an integer value (that is greater than 0 and less than 12096001 [two weeks, in seconds]).

Lookback: true
LookbackWindowSeconds: 3600

Then, in the SQL query, include the $pStartTimeVar and $pEndTimeVar session variables to define a window of time. For example:

Query: |-
    SELECT * FROM panther_logs.public.aws_cloudtrail 
    WHERE p_event_time between $pStartTimeVar and $pEndTimeVar 
    LIMIT 10;

The value of these variables will be set according to the following formulas:

• $pStartTimeVar = $pEndTimeVar - LookbackWindowSeconds

• $pEndTimeVar = <time_of_scheduled_query>

In full, the Scheduled Query YAML file would look like:

AnalysisType: scheduled_query
QueryName: ScheduledQuery_Example
Description: Example of a scheduled query for PAT
Enabled: true
Lookback: true
LookbackWindowSeconds: 3600
Query: |-
    SELECT * FROM panther_logs.public.aws_cloudtrail 
    WHERE p_event_time between $pStartTimeVar and $pEndTimeVar 
    LIMIT 10;
Tags:
  - Your tags   
Schedule:
  CronExpression: "0 0 29 2 *"
  RateMinutes: 0
  TimeoutMinutes: 2

Using Saved and Scheduled Queries

How to delete or download a Saved Query

You can delete Saved Queries individually or in bulk. Note that if a Saved Query is scheduled (i.e., it's a Scheduled Query), it must be unlinked from any Scheduled Rules it's associated to in order to be deleted.

1. Log in to the Panther Console, then navigate to Investigate > Saved Queries.

2. In the list of Saved Queries, find the query or queries you'd like to download or delete. Check the box to the left of the name of each query.

3. At the top of the page, click either Download or Delete.

   • If you clicked Download, a saved_queries.zip file will be downloaded.

   • If you clicked Delete, an Attention! modal will pop up. Click Confirm.

How to deactivate a Scheduled Query

1. Log in to the Panther Console, then navigate to Investigate > Saved Queries.

2. Find the Scheduled Query you'd like to deactivate, and in the upper right corner of its tile, click the three dots icon.

3. In the dropdown menu, click Edit Query Metadata.

4. In the Update Query form, toggle the setting Is it active? to OFF to disable the query.

5. Click Update Query to save your changes.

Update a Saved Query's metadata

To edit a Saved Query's name, tags, description, and default database (and, for Scheduled Queries, whether it's active, and the period or cron expression):

1. Log in to the Panther Console, then navigate to Investigate > Saved Queries.

2. Locate the query you'd like to edit, and click the three dots icon in the upper right corner of its tile.

3. In the dropdown menu, click Edit Query Metadata.

4. Make changes in the Update Query form as needed.

5. Click Update Query.

Search for Saved Queries

On the Saved Queries page, you can search for queries using:

• The search bar at the top of the queries list

• The date range selector in the upper right corner

• The Filters option in the upper right corner

  • Filter by whether the query is scheduled, whether its active, its type (Native SQL or Query Builder), or by up to 100 tags.

Click on the name of the Saved Query to be taken directly to Data Explorer (for Native SQL queries) or Query Builder (for Query Builder queries) with the query populated.

Use LIMITs in Scheduled Queries

In the Panther Data Lake settings page, you can optionally enable a setting that will check if a Scheduled Query has a LIMIT clause specified. Use this option if you're concerned about a Scheduled Query unintentionally returning thousands of results, potentially resulting in alert delays, Denial of Service (DoS) for downstream systems and general cleanup overhead from poorly tuned queries.

1. In the upper right corner of the Panther Console, click the gear icon. In the dropdown menu that appears, click General.

2. Click the Data Lake tab.

3. Scroll down to the Scheduled Queries header. Below the header, you will see the LIMIT clause toggle setting:

4. Toggle the LIMIT Clause for Scheduled Queries setting to ON to start enforcing LIMITs in Scheduled Queries.

When this field is set to ON, any new Scheduled Queries marked as active cannot be saved unless a LIMIT clause is specified in the query definition.

Existing Scheduled Queries without a LIMIT clause will appear with a warning message in the list of Saved Queries, and edits cannot be saved unless a LIMIT clause is included.

The setting only checks for the existence of a LIMIT clause anywhere in the Saved Query. It does not check specifically for outer LIMIT clauses.

Exporting scheduled queries from your Panther Console

You can export a .zip file of all of the detections and scheduled queries in your Panther Console:

1. In the lefthand side of the Panther Console, click Build > Bulk Uploader.

2. In the upper right side of the Bulk Uploader page, click Download all entities.

Saved Query specification reference

Required fields are in bold.

A complete list of saved query specification fields:

Scheduled Query specification reference

Required fields are in bold.

A complete list of scheduled query specification fields:

CronExpression: "0 0 29 2 *"
  RateMinutes: 0
  TimeoutMinutes: 2