v1.33

Apr 19, 2022

New and Noteworthy

Data Replay is now available on Detection pages in the Panther Console.
- Use Data Replay to test your detections with historical data. When writing or updating a detection, you can simulate what type of alerts you are likely to receive before deploying the detection. Use this feature to fine-tune your detections and reduce alert fatigue.
- Data Replay is located on Detection pages under the Functions & Tests tab.
You can now query your Panther data lake via the Panther API. Available operations include:
- Listing all available databases, tables, and columns within the data lake.
- Executing a Data Explorer query by providing a database and a SQL string.
- Executing an Indicator Search query.
- Reference the documentation for additional information and more operations.
Added Log Source Operations pages for individual log source pages in the Panther Console. Use these pages to monitor log source ingestion and health.

Panther Console users can now view raw data coming into Panther in the schema page.
- Use this feature to inspect raw logs to troubleshoot issues with schemas or sources.

Added a “View data” button next to schemas in the Schemas section of the Panther Console to enable users to quickly pivot to Data Explorer with a contextual query.
Log source cards in the Panther Console will now display a red status health error when a classification error occurs.
- Log sources that were previously shown as healthy may now appear unhealthy based on ongoing schema classification failures. Previously this was handled via a system health notification rather than a persistent status indicating an unhealthy log source. These sources did not become unhealthy because of this new release; this status indicator is just now visible because of this new functionality.
The Detections page in the Panther Console now shows enabled and disabled detections by default.
Optimized Panther View Creation to only use active, non-empty views in Snowflake, preventing potential issues with reaching maximum view size limits.
Panther’s CloudFormation deployment parameters have been updated.

Fixed a bug in the Lookup Table creation process that showed options that should be unavailable based on the setup method.