Zendesk is a cloud-based help desk management platform used by organizations to build customer service portals, knowledge bases, and online communities. Panther can collect, normalize, and monitor Zendesk logs to help you identify abnormal activity in real time. Your normalized log data is then retained to power future security investigations in a data lake powered by the cloud-native data platform, Snowflake.
Zendesk audit logs show various changes in your Zendesk account, such as account changes, user changes, app changes, web widget changes, business rule changes, ticket deletions, and settings changes. Some common security use cases for Zendesk logs include monitoring for:
Panther supports pulling logs directly from Zendesk. Panther can fetch Zendesk audit logs by querying the Zendesk Support API. Setting Zendesk up in Panther is fast and easy - you can choose between creating an OAuth App in your Zendesk account, generating an API token, or submitting your Zendesk Support Admin email and password for basic authentication.
For more details on onboarding Zendesk logs or for supported log schema, you can view our Zendesk documentation here.
As Panther ingests Zendesk logs, they are parsed, normalized, and stored in a Snowflake security data lake. This allows you to write detections, identify anomalies, and conduct investigations in the context of days, weeks, or months of data.
Panther applies normalization fields to log records, which standardizes names for attributes and enables you to correlate data across all of your log sources. Panther’s handy search tools - such as Query Builder, Data Explorer, and Indicator Search - allow you to investigate your normalized logs for suspicious activity or vulnerabilities. For more information on searching logs, check out our documentation on Investigations & Search.
With Panther, you aren’t confined to restrictive detections or proprietary code bases as seen in many SIEM solutions. Panther is built around detection-as-code principles, giving you the ability to write Python to define detection logic and to integrate external systems like version control and CI/CD pipelines into your detection engineering processes. This results in powerful, flexible, and reusable scripting of detections for your security team.
Pre-built detections for Zendesk are available in Panther, offering you the ability to immediately monitor for common IoCs and threats. You can explore our built-in detection coverage for Zendesk logs here.
Panther generates alerts when your detection rules or policies for Zendesk are triggered, and integrates with a variety of alert destinations to allow for intuitive management of any alerts. Alerts can also be sent to alert context or SOAR platforms for more remediation options.
Alerts are categorized by five different severity levels: Info, Low, Medium, High, and Critical. Your security team has the ability to dynamically assign severity based on specific log event attributes.
If you have any questions about onboarding or monitoring Zendesk logs in Panther, our customer support team is here to help. All customers have access to support via a dedicated Slack channel, email, or in-app messenger.
You can view our documentation on configuring and monitoring Zendesk logs here, or customers can sign up for the Panther Community to share best practices or custom detections for Zendesk logs.
With Panther, your team doesn’t have to struggle with restrictive detection logic, pay excessive costs to keep up with the growth of cloud app data, or waste time and resources on operational overhead. Panther is built by a team of security engineers who struggled with other SIEM solutions first-hand, and built an intuitive, cloud-native platform to meet today’s security needs.
Panther is a cloud-native SIEM built for security operations at scale, offering flexible detection-as-code, intuitive security workflows, and actionable real-time alerts. For a powerful, fast, and scalable SIEM solution for Zendesk, request a demo today.
Monitor Jamf Pro login events for suspicious activity.
Monitor your sales operations data for suspicious activity.
Monitor your password management platform for suspicious activity.
Inspect all SSH access activity for signs of suspicious behavior.
Monitor events within your MongoDB Atlas organization or project.
Identify any vulnerabilities within your GitHub repositories.
Gain complete visibility into Sysdig platform activity.
Monitor abnormal user activity within your Zoom account.
