Monitor system activity for suspicious behavior

Request a DemoRead the Docs

Monitor Fluentd Logs to gain complete security visibility into system activity with Panther’s fluentd integration.

Fluentd is an open source data collector for unifying various application logs, network protocols, IoT devices, and other data sources. Panther can collect, normalize, and monitor Fluentd logs to identify suspicious activity in real time. Your normalized data is then retained to power future security investigations in a serverless data lake powered by AWS or the cloud-native data platform, Snowflake.

Use Panther’s built in rules to monitor activity, or write your own detections in Python to fit your internal business use cases.

Use Cases

Common security use cases for Fluentd with Panther include:

  • Kubernetes Audit
  • Syslog
  • Application Logs
  • Tailing Log Files on Linux Machines

How it Works

The integration is simple and fast:

  • Configure Fluentd to send data to either Amazon S3 or SQS
  • Add your S3 Bucket or SQS Queue as a data source in Panther
  • Panther will parse, normalize, and analyze your log data in real-time
  • As detections are triggered, alerts are sent to your configured destinations
  • Normalized logs are retained in a data lake to power investigations with Panther’s Data Explorer

Learn more about Panther's supported log schema for Fluentd.