Panther AI

Overview

Panther AI encompasses a set of generative AI features aimed at speeding up your detection and response workflows.

[ TODO: add more content here describing features, once we have them nailed down ]

There are AI entry points in Panther in the following places:

• On the Search page

  • See AI event summaries in Search

• On the Alerts and alert details pages

  • See Using AI alert list and alert event summaries

Enabling Panther AI

To use Panther AI features, your Panther instance's Enable Panther AI setting must be set to ON, and your user role must have the Run Panther AI permission.

The Enable Panther AI setting is set to OFF by default, can only be updated by a user with the Edit Settings & SAML Preferences permission. Find this setting on the Settings > General page, within the Main Information tab:

Once Enable Panther AI is set to ON, the Run Panther AI permission will be:

• Granted automatically to the default Admin role

• Available to assign to additional roles. Learn how to update a role's permissions here.

  

Automated Search summary and alert triage

The Search Results and Alert Detail screens have introduced AI functionality that allows an analyst to tap a button in order to get an AI summarization of what is happening.

From the Search Results screen, simply tap the blue Summarize with AI button.

[COPIED TO ALERTS PAGE] From the Alert Detail screen, tap the blue Start Panther AI Triage button.

AI prompt settings

Use AI prompt settings to tailor AI-generated content in Panther to your preferences. To set your AI prompt settings:

1. Navigate to one of the AI entry points in Panther.

2. On the right side of the prompt bar, click the Edit prompt settings icon: .

3. Set the response length setting.

4. Click Save Settings.

AI settings are universally applied to all AI entry points in Panther, but are specific to each Panther user.

Response length

The response length AI setting has three possible values:

• Short: Runs quickly and produces a brief summary.

• Medium: Elaborates more than Short, but is usually shorter than five paragraphs.

• Long: Allows AI to analyze intricately, and can produce very long and informative outputs.

Example response lengths

do we want to provide an event here that the AI summarizes? or provide a prompt the AI answers?

Summarizing the below event (or alert),

{}

we could also use three expandable blocks instead of a table, if the responses are really long

Citations and fact-checking

When Panther AI aids in triaging or summarizing your data, it will return links to relevant data so you can verify its findings. Citations may include alerts, detections, and/or data queries.