New and Noteworthy

• Manage S3 log sources programmatically through the Panther REST API.

• Connect a GitHub repository to Panther so that edits to rules, scheduled rules, and simple detections made in the Panther Console open a pull request in the configured repository.

  • If you would like to participate in this closed beta, please contact Panther support.

• Download CSV data from the Visualizations tab and Custom Dashboards.

• Panther AI can post messages directly to a Slack channel from within an investigation via the Panther Slackbot integration, with a link back to the originating conversation.

  • Interactive sessions require user approval before sending; scheduled prompts and auto-triage send autonomously.

Enhancements

• Panther AI has been enhanced with the following:

  • Expand any AI-generated table into a full-screen modal, or copy table data as TSV for pasting into Excel, Google Sheets, or Notion.

  • The conversation history panel has been redesigned into a single-row layout.

• The Enrichments page has been refreshed with a new design, including updated onboarding and new filters.

Panther Developer Workflows

• A new Panther Terraform module version is available. The provider now uses the new REST API to manage S3 log sources.

• Since the last Panther release, the panther-analysis repository has published versions 3.105.0–3.106.0, which include:

  • New detection rules for AWS RDS and STS.

  • Scheduled rules and correlation rules converted to Unique Value Threshold rules.

  • 80 rules promoted from experimental to stable.

Bug Fixes

• Fixed an issue that caused errors when the requested events latency period was less than a minute.

• Fixed a crash on the Enrichment Onboarding page when clicking a puller provider if the log sources query errored or returned no data.

• Fixed an issue where a page-level rendering error persisted across subsequent navigations, causing every page to show the "Something went wrong" message until a page refresh.

• Fixed an issue where editing a CloudWatch log source would silently disable the "Retain envelope fields" option if the source was saved without reopening the Stream type settings.

• Resolved an issue where the Wiz Cloud puller would not report as unhealthy when its token was missing permissions for some of the configured log types.

• Fixed an issue where normalized event filters performed partial searches instead of exact searches against values in IN or NOT IN matchers.

• Fixed an issue where the sources list and related API calls returned only the first MB of results, causing sources to be hidden in the UI and creating processing issues after onboarding a large number of data sources.

• Fixed the display of IP enrichments on alert details when multiple values are present.

• Fixed drilldown behavior for PantherFlow searches.

• Added rate limiting to the Slack bot to reduce the risk of comments being blocked during high-volume AI activity.

• Fixed an issue preventing the API Playground and other browser-based tools from working with PATCH requests.

• Fixed event count reporting for correlation rule errors.

• Resolved additional Jira comment sync failures caused by formatting issues.