Product Updates

Panther AI has been enhanced with the following new features:

• Scheduled AI prompts let you automate recurring Panther AI queries on a schedule.

• AI tools for cloud resources and cloud security scanning.

• Provide personal context to Panther AI with personal AI preferences.

• Support for file attachments to provide additional context.

• MCP Integrations allow you to connect remote MCP servers to Panther AI, enabling it to invoke tools from third-party services—such as creating Jira issues, querying PagerDuty incidents, or searching Notion pages—directly from the Panther AI chat experience.

  • This feature is in closed beta. To request access to this feature, please contact your Panther support team.

Ingest SOCRadar incidents with Panther's new log source integration.

CloudWatch log sources now support retaining top-level envelope fields in a p_header field on each event.

SQL custom enrichment tables can be defined as YAML and deployed via the Panther Analysis Tool (PAT).

Panther AI can access web pages for additional context during analysis. Configure approved and forbidden domain lists and optionally require user approval before the AI accesses domains outside the approved list.

Set a delay tag to postpone AI alert auto-run triage, giving additional alert context time to accumulate before analysis begins.

Use the new panther_analysis_tool merge workflow to manage your detections content repository.

Ingest Iru (formerly Kandji) audit logs with Panther's new log source integration.

Ingest Upwind logs with Panther's new log source integration.

The Panther console supports light mode. Switch between light and dark mode in Profile Settings.

Set a unique value threshold for detections to control alert generation based on distinct field values observed over a time window.

Panther AI (including the navigation bar entry point, alert triage, AI risk scoring, and Search summarization) is now generally available, with the following feature enhancements in open beta:

• Describe a search in natural language and Panther AI will generate a PantherFlow query.

• Use the AI Detection Builder to create and modify detection rules using natural language prompts.

• When Panther AI wants to perform a sensitive action, it now requires human approval before execution.

Add filters to custom dashboards to drill down on certain fields across all visualizations.

Manually dispatch alerts to configured destinations from an alert's details page.

Set alert quality and add context tags to track resolution reasons and improve detection tuning.

Ingest AWS NLB logs with Panther's new log source integration.

Enrich incoming logs with data already in your data lake by creating custom enrichment sources with the output of a Scheduled Search.

Infer schemas from sample data of any format, not just JSON, with AI-assisted schema inference.

Ingest OpenAI audit logs with Panther's new log source integration.

The Enrichment details page includes enrichment data under the new “Lookup Table” tab. The updated page makes it easier to validate your data and edit your schemas.