Upwind Log Monitoring

Integration Overview

Upwind is a Cloud Native Application Protection Platform (CNAPP) that provides runtime visibility into cloud deployments, applications, and infrastructure, helping teams identify misconfigurations, vulnerabilities, and active threat behavior in real time. Panther integrates with Upwind to continuously ingest, normalize, and monitor Upwind detections, giving your security team a centralized view of runtime risk across your cloud environment. Normalized detection data is stored for future investigations in a Snowflake-powered, serverless security data lake.

Use Cases for Upwind Logs

Common SIEM use cases for Upwind logs include:

• Detecting lateral movement and suspicious process behavior in cloud workloads

• Correlating runtime detections with MITRE ATT&CK techniques across your security data

• Monitoring cloud resource exposure and policy violations in real time

Onboarding Upwind Logs in Panther

Panther's integration for Upwind is easy to configure, allowing you to onboard your log data in just a few minutes. Upwind logs are streamed to Panther through an HTTP webhook configured in the Upwind management console.

For more detailed steps on onboarding Upwind or for supported log schema, you can view our Upwind documentation here.