Amazon SNS Destination

Configuring Amazon SNS as an alert destination in your Panther Console

Overview

Destinations are integrations that receive alerts from rules, policies, system health notifications, and rule errors. Panther supports configuring Amazon Simple Notification Service (SNS) as the destination where you will receive alerts.

How to set up Amazon SNS alert destinations in Panther

SNS Prerequisites

The SNS Destination requires a Topic ARN. When an alert is forwarded to an SNS Destination, it publishes a JSON string to that topic.

1. In the AWS SNS console, create a new Topic or navigate to the topic you wish to add as a destination. We will be editing its permissions so Panther can publish messages to it:

2. After selecting the SNS topic, click Edit then scroll down and expand the "Access policy" section:

3. After expanding the "Access policy" section, add the following statement to the Statement block. Be sure to replace the Principal field with the AWS account ID where Panther is deployed and the Resource field with the ARN of your own SNS Topic and the ID of the AWS account it resides in.

       {
         "Sid": "AllowPantherAlarming",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::<YOUR-PANTHER-AWS-ACCOUNT-ID>:root"
         },
         "Action": "sns:Publish",
         "Resource": "<SNS-DESTINATION-ARN>:<SNS-AWS-ACCOUNT-ID>:<YOUR-TOPIC-NAME>"
       }

   • To find your Panther AWS account ID, go to Settings > General in the Panther Console. It is located in the footer:

Configure the Destination in Panther

1. Log in to the Panther Console and navigate to Configure > Alert Destinations.

2. Click +Add your first Destination.

   • If you have already created Destinations, click Create New in the upper right side of the page to add a new Destination.

3. Click AWS SNS in the list of options.

4. Fill out the form to configure the Destination:

   • Display Name: Enter a descriptive name.

   • Topic ARN: Enter the value of the Topic ARN from the SNS Prerequisites section.

   • Severity: Select the severity level of alerts to send to this Destination.

   • Alert Types: Select the alert types to send to this Destination.

   • Log Type: By default, we will send alerts from all log types. Specify log types here if you want to only send alerts from specific log types.

5. Click Add Destination.

6. On the next screen, click Finish Setup to complete your setup, or click Send Test Alert to test your setup.

   • Your SNS Topic will now be able to receive Panther alerts. If your goal is to set up email notifications with this topic, continue below.

Optional: Creating Email Notifications

1. In the AWS SNS console, click Create Subscription on the topic you just created. The topic ARN should match the topic you created.

2. Select Email in the protocol dropdown menu and enter the email address you would like to receive alerts to.

3. Click Create subscription

4. Confirm the subscription sent to your email before receiving alerts from this topic.\

Additional Information on Destinations

For more information on alert routing order, modifying or deleting destinations, and workflow automation, please see the Panther docs: Destinations.