New and Noteworthy

• Use the Panther Log Forwarder source to send on-prem logs to Panther.

• Ingest Cursor audit logs over an HTTP webhook for visibility into Cursor platform activity.

• Bring on-prem firewall activity into Panther with a new log source for Palo Alto Next-Generation Firewall logs.

• Redesigned Settings page brings all configuration into a single full-page view with a persistent sidebar.

Enhancements

• Create a Github PR for data models, global helpers, and deletions.

• Schemas page now hides archived schemas by default; use the Status filter to show them.

• Enrichment and custom enrichment uploads surface actionable errors for duplicate keys and invalid files.

Schema Updates

• Identity Threat Protection fields added to Okta.SystemLog schema.

Bug Fixes

• Azure and Microsoft schemas accept additional timestamp formats.

• Sublime schemas support a new timestamp format.

• Runbook markdown no longer overflows its alert grid column.

• Panther AI no longer hangs when slow queries exhaust the time budget.

• Alerts with an existing triage conversation now show View instead of Start Panther AI Triage.

• OTX enrichment supports threat-intel pulses up to 100MB per pulse.

• Querying p_any fields that don't exist now returns a clear validation error.

• Fixed issue showing incorrect Bytes Processed for customers with many log sources.

• Detections list page slowdowns resolved for tenants with many detections.

• Fixed Atlassian Audit pagination to align with API semantics, preventing cursor-stall replay loops that could re-ingest historical events and in rare cases, skip events.

Announcements

• Panther audit log ingestion is enabled on every instance by default.