• Docker
  • Discord logo
  • Gusto logo
  • Teleport Logo
  • Grail Logo
  • Funnel
  • Elementor Logo
  • Dropbox Logo
  • Asana Logo
  • Benchling logo
  • VGS Logo
  • Iterable
  • JupiterOne
  • HubSpot Logo
  • Zapier Logo
  • Domino Logo
  • Loom logo
  • enlaceHealth
  • Highspot
  • Snowflake Logo
  • Circle Logo
  • Infoblox Logo
  • Snyk Logo
  • CMS: Centers for Medicare & Medicaid Services
  • Avetta
  • coinbase logo
  • Mattermost Logo
  • Intercom Logo
  • FloQast Logo
  • Jumio
  • Persona logo
  • Auth0 Logo
  • Cedar logo
  • Framer Logo
  • LaunchDarkly Logo
  • Illuvium
  • Watt IQ logo

How It Works

Panther is a modern SIEM that transforms terabytes of raw logs per day into a structured security data lake to power real-time detection, swift incident response, and thorough investigations.

Panther Makes Security Operations Painless

Effortless Data Ingestion

Built-in support for common data transports such as S3, SQS, SNS, and out-of-the-box integrations for critical log sources like Duo, Okta, Slack, G Workspaces, and more.

Log normalization

Logs are parsed and IoC fields like domains and IPs are normalized to support analysis, searches and correlations across all log types.


Highly customizable Python-based detections, a built-in testing framework, and the ability to create detections directly in the UI or with a CLI-based workflow.

Security data lake

Normalized security data is aggregated in a high-performance, scalable, and cost-effective data lake capable of running queries over massive data sets in minutes.

Quickly search IoCs

Query petabytes of data and find related activity based on attributes like usernames, emails, IPs, and more to tell the full story during an incident.

500+ Pre-Built Detections

Provided by Panther to analyze key log sources and support common security and compliance needs. Built-in detections also give customers a starting point to customize as needed.

Take a Video Tour


More and more security teams are adopting developer-centric approaches to writing, testing and hardening detections, so we built Panther with “Detection-as-Code” to make this easy and practical, using Python.


With Panther, you can dynamically add helpful context to alerts, dispatch them into notification systems for triage, and enable hands-off response via automation platforms.


Panther normalizes IOCs across all log sources as data is ingested, then stores it in a structured security data lake to enable thorough investigations and effective threat hunting.