Panther

https://docs.panther.com/
Admin
Panther is a cloud-native security operations platform that detects and responds to threats through...
Tokens:588,054
Snippets:7,063
Trust Score:9.8
Update:5 months ago
Show doc for...
Tokens:
Raw
### API Request Example

Source: https://docs.panther.com/alerts/destinations/custom_webhook

Example of how to make an HTTP GET request to the documentation page with an 'ask' query parameter to retrieve specific information.

```http
GET https://docs.panther.com/alerts/destinations/custom_webhook.md?ask=<question>
```

--------------------------------

### Query Documentation Dynamically

Source: https://docs.panther.com/enrichment/tor-exit-nodes

This example shows how to query the documentation for additional information using an HTTP GET request with the `ask` query parameter.

```http
GET https://docs.panther.com/enrichment/tor-exit-nodes.md?ask=<question>
```

--------------------------------

### Querying Documentation with GET Request

Source: https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/route-53-domains

This example shows how to dynamically query the documentation using an HTTP GET request with the 'ask' query parameter. This is useful for retrieving specific information not immediately apparent on the page.

```http
GET https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/route-53-domains.md?ask=<question>
```

--------------------------------

### Querying Documentation Dynamically

Source: https://docs.panther.com/data-onboarding/custom-log-types/reference

This example shows how to query the documentation dynamically using an HTTP GET request with the `ask` query parameter.

```http
GET https://docs.panther.com/data-onboarding/custom-log-types/reference.md?ask=<question>
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.panther.com/search/data-explorer/example-queries

Demonstrates how to query documentation dynamically using an HTTP GET request with the `ask` query parameter. This is useful for retrieving specific information or clarifications not explicitly present on the page.

```http
GET https://docs.panther.com/search/data-explorer/example-queries.md?ask=<question>
```

--------------------------------

### Query Documentation API Example

Source: https://docs.panther.com/detections/policies

Example of how to query the Panther documentation dynamically using an HTTP GET request with the 'ask' query parameter.

```http
GET https://docs.panther.com/detections/policies.md?ask=<question>
```

--------------------------------

### Verify Panther CLI Tool Setup

Source: https://docs.panther.com/system-configuration/panther-deployment-types/cloud-connected/set-up

Run this command to ensure the `panther-cloud-connected-setup` tool is installed correctly and to clean any previous state.

```bash
panther-cloud-connected-setup --clean
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.panther.com/data-onboarding/data-pipeline-tools/fluentd/macos-system-logs-to-s3-via-fluentd

Perform an HTTP GET request to the current page URL with the 'ask' query parameter to get dynamic answers. The question should be specific and self-contained.

```HTTP
GET https://docs.panther.com/data-onboarding/data-pipeline-tools/fluentd/macos-system-logs-to-s3-via-fluentd.md?ask=<question>
```

--------------------------------

### Querying Documentation with 'ask' Parameter

Source: https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/iam-role

This example demonstrates how to query the documentation dynamically using the 'ask' query parameter in an HTTP GET request. This is useful for retrieving specific information not explicitly present on the page or for clarification.

```http
GET https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/iam-role.md?ask=<question>
```

--------------------------------

### Query Documentation Dynamically

Source: https://docs.panther.com/search/data-explorer/example-queries/s3-access-logs-queries

This example demonstrates how to dynamically query the documentation by performing an HTTP GET request with an 'ask' query parameter. This is useful for retrieving specific information not explicitly present on the page or for clarification.

```http
GET https://docs.panther.com/search/data-explorer/example-queries/s3-access-logs-queries.md?ask=<question>
```

--------------------------------

### Install PAT from Source (Development)

Source: https://docs.panther.com/panther-developer-workflows/detections-repo/pat/install-configure-and-authenticate-with-pat

Commands to install PAT from source for development purposes, including setting up dependencies and performing a development installation.

```bash
make install
pipenv run -- pip3 install -e .
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.panther.com/enrichment/snowflake

Perform an HTTP GET request to the current page URL with the 'ask' query parameter to dynamically query the documentation. The question should be specific and self-contained. Use this when the answer is not explicitly present, for clarification, or to retrieve related sections.

```bash
GET https://docs.panther.com/enrichment/snowflake.md?ask=<question>
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.panther.com/pantherflow

To get additional information not directly present on the page, perform an HTTP GET request to the page URL with the 'ask' query parameter. The question should be specific and self-contained.

```http
GET https://docs.panther.com/pantherflow.md?ask=<question>
```

--------------------------------

### Dynamic Documentation Query Example

Source: https://docs.panther.com/data-onboarding/data-pipeline-tools/fluentd/general-log-forwarding-via-fluentd

Perform an HTTP GET request to the current page URL with the 'ask' query parameter to dynamically query the documentation. The question should be specific and in natural language.

```HTTP
GET https://docs.panther.com/data-onboarding/data-pipeline-tools/fluentd/general-log-forwarding-via-fluentd.md?ask=<question>
```

--------------------------------

### Run Panther Cloud Connected Setup Tool

Source: https://docs.panther.com/system-configuration/panther-deployment-types/cloud-connected/set-up

Execute the Panther Cloud Connected setup tool with your configuration file. Use the --verbose flag for detailed logging.

```bash
./panther-cloud-connected-setup --config-file config.yml
```

```bash
./panther-cloud-connected-setup --config-file config.yml --verbose
```

--------------------------------

### Set Up Local Python Environment and Run Tests

Source: https://docs.panther.com/panther-developer-workflows/detections-repo/setup/deprecated/private-cloned-repo

Initialize the Python virtual environment and execute the test suite to verify your setup and identify any initial rule errors.

```bash
make venv
make test
```

--------------------------------

### Copy Example Rule Files

Source: https://docs.panther.com/panther-developer-workflows/detections-repo/setup/deprecated/private-cloned-repo

Copy the example rule template files from the 'templates/' directory into your new local rules directory.

```bash
cp templates/example_rule.* rules/my_local_rules
```

--------------------------------

### Create Role and Invite User (Node.js Example)

Source: https://docs.panther.com/panther-developer-workflows/api/graphql/user-management

Demonstrates creating a new user administrator role and then inviting a user to that role using Node.js.

```APIDOC
## Create Role and Invite User (Node.js)

### Description
This example shows how to first create a new role with specific permissions and then invite a user, assigning them to the newly created role, using the `graphql-request` library for Node.js.

### Prerequisites
- Install the necessary library: `npm install graphql-request` or `yarn add graphql-request`.
- Replace `YOUR_PANTHER_API_URL` and `YOUR_API_KEY` with your actual API endpoint and key.

### Code Example
```javascript
import { GraphQLClient, gql } from "graphql-request";

const client = new GraphQLClient(
  "YOUR_PANTHER_API_URL",
  { headers: { "X-API-Key": "YOUR_API_KEY" } }
);

// `createUserAdmin` is a nickname for the query. You can fully omit it.
const createUserAdmin = gql`
  mutation newAdminRole {
    createRole(
      input: {
        name: "user-admin"
        permissions: [
          UserRead
          UserModify
          OrganizationAPITokenRead
          GeneralSettingsRead
        ]
      }
    ) {
      role {
        name
        id
      }
    }
  }
`;

// `inviteUser` is a nickname for the mutation. You can fully omit it.
const inviteUser = gql`
  mutation inviteUser($input: InviteUserInput!) {
    inviteUser(input: $input) {
      user {
        id
        email
      }
    }
  }
`;

(async () => {
  try {
    const newRoleData = await client.request(createUserAdmin);

    const inviteUserOutput = await client.request(inviteUser, {
      input: {
        email: "newAdmin@domain.local",
        givenName: "user",
        familyName: "admin",
        role: {
          kind: "ID",
          value: newRoleData.createRole.role.id
        }
      }
    });

    console.log(
      `Successfully invited user ${inviteUserOutput.inviteUser.user.email} with role ${newRoleData.createRole.role.name}.`
    );
  } catch (err) {
    console.error(err);
  }
})();

```
```

--------------------------------

### Example PAT CLI Usage with Pipenv

Source: https://docs.panther.com/panther-developer-workflows/detections-repo/pat/install-configure-and-authenticate-with-pat

Demonstrates how to execute PAT commands using pipenv, showing examples for testing and uploading assets.

```bash
pipenv run panther_analysis_tool test
...
pipenv run pat upload
...
```

--------------------------------

### List Panther-Managed Schemas

Source: https://docs.panther.com/panther-developer-workflows/pantherlog

Use this command to view a list of schemas managed by Panther. No setup is required beyond having the pantherlog tool installed.

```bash
./pantherlog list-schemas
```

--------------------------------

### Golang GraphQL Query for Alerts

Source: https://docs.panther.com/panther-developer-workflows/api/graphql

Use the go-graphql-client library to query alerts. Install the library using 'go get -u github.com/hasura/go-graphql-client'. Remember to replace placeholder values.

```go
// go get -u github.com/hasura/go-graphql-client

package main

import (
  "context"
  "encoding/json"
  "fmt"
  "net/http"

  "github.com/hasura/go-graphql-client"
)

// Strongly-typed languages don't pair well with GraphQL
var query struct {
  Alerts struct {
    Edges []struct {
      Node struct {
        Id       graphql.String
        Title    graphql.String
        Severity graphql.String
        Status   graphql.String
      }
    }
    PageInfo struct {
      HasNextPage graphql.Boolean
      EndCursor   graphql.String
    }
  } `graphql:"alerts(input: { createdAtAfter: \"2023-06-14T21:00:00Z\", createdAtBefore: \"2023-06-21T21:59:59Z\" })"`
}

func main() {
  client := graphql.
    NewClient("YOUR_PANTHER_API_URL", nil).
    WithRequestModifier(func(req *http.Request) {
      req.Header.Set("X-API-KEY", "YOUR_API_KEY")
    })

  if err := client.Query(context.Background(), &query, nil); err != nil {
    panic(err)
  }

  formattedResult, _ := json.MarshalIndent(query.Alerts, "", "\t")
  fmt.Println(string(formattedResult))
  fmt.Println(query.Alerts.PageInfo.HasNextPage)
}
```

--------------------------------

### Create Role and Invite User (Python Example)

Source: https://docs.panther.com/panther-developer-workflows/api/graphql/user-management

Demonstrates creating a new user administrator role and then inviting a user to that role using Python.

```APIDOC
## Create Role and Invite User (Python)

### Description
This example shows how to first create a new role with specific permissions and then invite a user, assigning them to the newly created role, using the Python `gql` library.

### Prerequisites
- Install the necessary libraries: `pip install gql aiohttp`
- Replace `YOUR_PANTHER_API_URL` and `YOUR_API_KEY` with your actual API endpoint and key.

### Code Example
```python
# pip install gql aiohttp

from gql import gql, Client
from gql.transport.aiohttp import AIOHTTPTransport

transport = AIOHTTPTransport(
  url="YOUR_PANTHER_API_URL",
  headers={"X-API-Key": "YOUR_API_KEY"},
)

client = Client(transport=transport, fetch_schema_from_transport=True)

create_user_admin = gql(
  """
  mutation newAdminRole {
    createRole (input: {
      name: "user-admin"
      permissions: [
        UserRead
        UserModify
        OrganizationAPITokenRead
        GeneralSettingsRead
      ]
    }) 
    {
      role {
        name
        id
      }
    }
  }
  """
)

invite_user = gql(
  """
  mutation inviteUser($input: InviteUserInput!) {
    inviteUser (input: $input) {
      user {
        id
        email
      }
    }
  }
  """
)

new_role_data = client.execute(
  create_user_admin
)

print(f'new role ID is {new_role_data["createRole"]["role"]["id"]}')

response_data = client.execute(
  invite_user,
  variable_values= {
    "input": {
      "email": "newAdmin@domain.local",
      "givenName": "user",
      "familyName": "admin",
      "role": {
        "kind": "ID",
        "value": new_role_data["createRole"]["role"]["id"],
      }
    }
  }
)

print(f'Successfully invited user {response_data["inviteUser"]["user"]["email"]} with role {new_role_data["createRole"]["role"]["name"]}.'
```
```

--------------------------------

### Install Fluentd MacOS Log Plugin

Source: https://docs.panther.com/data-onboarding/data-pipeline-tools/fluentd/macos-system-logs-to-s3-via-fluentd

Installs the necessary Fluentd plugin for collecting MacOS logs. Ensure td-agent is installed first.

```bash
sudo /opt/td-agent/bin/fluent-gem install fluent-plugin-macos-log
```

--------------------------------

### Install Panther Log Forwarder

Source: https://docs.panther.com/data-onboarding/panther-log-forwarder

Commands to verify the downloaded release checksum, extract the tarball, and run the installation script. The installer typically restarts the service automatically.

```bash
sha256sum -c panther-log-forwarder_linux_amd64.tar.gz.sha256
tar -xzf panther-log-forwarder_linux_amd64.tar.gz
cd panther-log-forwarder
sudo ./install.sh
```

--------------------------------

### Install Panther Backend and Pipelines

Source: https://docs.panther.com/panther-developer-workflows/converting-sigma-rules

Run this command after installing sigma-cli to set up the Panther backend and pipelines for rule conversion.

```bash
sigma plugin install panther
```

--------------------------------

### Querying Documentation via GET Request

Source: https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd

To get information not directly on the page, make a GET request to the page URL with an 'ask' query parameter containing your question.

```http
GET https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd.md?ask=<question>
```

--------------------------------

### Query Documentation Dynamically

Source: https://docs.panther.com/panther-developer-workflows/api/graphql/data-lake-queries

Demonstrates how to query this documentation dynamically using an HTTP GET request with the `ask` query parameter. Useful for retrieving specific information not explicitly present or for clarification.

```http
GET https://docs.panther.com/panther-developer-workflows/api/graphql/data-lake-queries.md?ask=<question>
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.panther.com/system-configuration/saml/gsuite

Perform an HTTP GET request on a page URL with the 'ask' query parameter to get dynamic answers. The question should be specific and self-contained.

```http
GET https://docs.panther.com/system-configuration/saml/gsuite.md?ask=<question>
```

--------------------------------

### Example using same match values

Source: https://docs.panther.com/detections/correlation-rules/correlation-rule-reference

Demonstrates how to use `Match` fields within `Transitions` to link events in a sequence. This example shows matching on the same IP address field for both the 'Failed Login' and 'Successful Login' transitions.

```yaml
Detection:
  - Sequence:
      - ID: Failed Login
        RuleID: Standard.BruteForceByIP
        MinMatchCount: 10
      - ID: Successful Login
        RuleID: Okta.Login.Success
    Transitions:
      - ID: Brute Force Login Success
        From: Failed Login
        To: Successful Login
        WithinTimeFrameMinutes: 10
        Match:
          - On: p_alert_context.ip     // these should be the same
      - ID: Gained Root Access
        From: Successful Login
        To: Root Login
        Match:
          - From: p_alert_context.ip  // these should be the same
            To: p_alert_context.sourceIPAddress
```

--------------------------------

### Querying Documentation with GET Request

Source: https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/cloudtrail-meta

To get additional information not directly present on the page, perform an HTTP GET request with the 'ask' query parameter. The question should be specific and self-contained.

```http
GET https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/cloudtrail-meta.md?ask=<question>
```

--------------------------------

### Start Node.js Server

Source: https://docs.panther.com/alerts/destinations/custom_webhook

Command to execute the Node.js webhook server script.

```shell
> node webhook.js
server is listening on 8081
```

--------------------------------

### Query Documentation with HTTP GET

Source: https://docs.panther.com/panther-developer-workflows

Perform an HTTP GET request on the current page URL with the `ask` query parameter to get dynamic answers from the documentation. The question should be specific and self-contained.

```http
GET https://docs.panther.com/panther-developer-workflows.md?ask=<question>
```

--------------------------------

### Start Fluentd Service

Source: https://docs.panther.com/data-onboarding/data-pipeline-tools/fluentd/syslog-to-s3-via-fluentd

Start the Fluentd service using systemctl. This command is used after configuring Fluentd to apply the changes.

```bash
$ sudo systemctl start td-agent.service
```

--------------------------------

### Query Documentation via HTTP GET

Source: https://docs.panther.com/panther-developer-workflows/api/graphql/schemas

To get information not explicitly on the page, make an HTTP GET request to the page URL with the `ask` query parameter. The question should be specific and self-contained.

```http
GET https://docs.panther.com/panther-developer-workflows/api/graphql/schemas.md?ask=<question>
```

--------------------------------

### Querying Documentation with GET Request

Source: https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/s3-bucket

To get more information not directly on the page, make an HTTP GET request to the current page URL with the `ask` query parameter. The question should be specific and self-contained.

```http
GET https://docs.panther.com/cloud-scanning/cloud-resource-attributes/aws/s3-bucket.md?ask=<question>
```

--------------------------------

### Log Schema Example

Source: https://docs.panther.com/data-onboarding/custom-log-types

Example of a YAML schema definition for parsing a log.

```yaml
fields:
- name: id
  description: Unique log identifier
  type: string
  required: true
- name: timestamp
  description: Event timestamp
  type: timestamp
  timeFormats: 
   - rfc3339
  isEventTime: true
- name: event
  description: Event details
  type: object
  fields:
  - name: type
    description: Type of event
    type: string
  - name: priority
    description: Event priority level
    type: string
  - name: message
    description: Event message
    type: string
  - name: source
    description: Source information
    type: object
    fields:
    - name: ip
      description: Source IP address
      type: string
      indicators: [ ip ]
    - name: user
      description: Username
      type: string
  - name: details
    description: Additional event details
    type: object
    fields:
    - name: action
      description: Action performed
      type: string
    - name: reason
      description: Reason for action (if applicable)
      type: string
```

--------------------------------

### Perform HTTP GET Request for Dynamic Documentation Query

Source: https://docs.panther.com/pantherflow/example-queries/panther-audit-logs

Demonstrates how to query documentation dynamically using an HTTP GET request with the `ask` query parameter. This is useful for retrieving specific information not explicitly present on the page.

```http
GET https://docs.panther.com/pantherflow/example-queries/panther-audit-logs.md?ask=<question>
```

--------------------------------

### Install PAT from Source (Outside Virtual Environment)

Source: https://docs.panther.com/panther-developer-workflows/detections-repo/pat/install-configure-and-authenticate-with-pat

Commands to install PAT directly from source, allowing its use outside of a virtual environment. This is useful for development workflows.

```bash
make deps
pip3 install -e .
```
Tokens:
Raw