Panther

No entries match these filters. Clear filters

1. updated seen Sep 7, 2026 · issue 067

   Panther v1.129 adds an Infrastructure Cost Dashboard to track usage and billing trends.

   └──▷ HOW TO FIND IT
   Review current Panther infrastructure spend and billing trends to forecast costs or identify unexpected usage spikes.
   📍In the Panther console, navigate to the Infrastructure Cost Dashboard to view usage metrics and billing trends.
2. v1.126 seen Sep 7, 2026 · issue 067

   Panther v1.126 adds Cursor audit logs, Palo Alto NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. log source, Log Forwarder for on-prem, and a redesigned Settings page.

   └──▷ HOW TO FIND IT
   Stream Cursor audit logs into Panther for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. activity monitoring by configuring an HTTP webhook source.
   📍In Panther, go to Log Sources › Create New Source, select HTTP Webhook, choose Cursor as the log type, and copy the generated webhook URL into your Cursor audit log export settings.
   Ingest on-prem Palo Alto NGFW syslog traffic into Panther without routing it through a cloud forwarder first.
   📍In Panther, go to Log Sources › Create New Source, select Palo Alto Next-Generation Firewall, configure the listener or Log Forwarder endpoint, and point your NGFW syslog output at the provided address.
   • Adds a new Panther Log Forwarder source to send on-prem logs to Panther.
   • Adds ingestion of Cursor audit logs over an HTTP webhook for visibility into Cursor platform activity.
   • Adds a new log source for Palo Alto Next-Generation Firewall logs to bring on-prem firewall activity into Panther.
   • Redesigned Settings page consolidates all configuration into a single full-page view with a persistent sidebar.
   • Enables creation of GitHub PRs for data models, global helpers, and deletions.

   +3 more show less

   • Adds Identity Threat Protection fields to the Okta.SystemLog schema.
   • Schemas page now hides archived schemas by default, with a Status filter to show them.
   • Enrichment and custom enrichment uploads now surface actionable errors for duplicate keys and invalid files.
   • Adds a new Panther Log Forwarder source to send on-prem logs to Panther.
   • Adds ingestion of Cursor audit logs over an HTTP webhook for visibility into Cursor platform activity.
   • Adds a new log source for Palo Alto Next-Generation Firewall logs to bring on-prem firewall activity into Panther.
   • Enables creation of GitHub PRs for data models, global helpers, and deletions.

   4 more in Everything

3. v1.127 seen Sep 7, 2026 · issue 067

   Panther v1.127 adds Claude Code/Cowork log sources, AI auto-triage deferral, Log Forwarder for Palo Alto NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports., and new admin RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for AI scheduled prompts.

   └──▷ HOW TO FIND IT
   Force a compromised or departing user out of all active Panther sessions immediately from the admin console.
   📍In Panther, go to Settings › Users Management, select the target user, and choose Sign out of all active sessions.
   Grant a view-only admin visibility into private AI scheduled prompts without allowing modifications.
   📍In Panther, go to Settings › Users Management, select the user, and assign the ViewAIPrivateResponses role.
   Route Palo Alto NGFW logs into Panther using the new Log Forwarder transport instead of direct S3 or SQS ingestion.
   📍In Panther, go to Log Sources › Add Log Source, select Palo Alto Next-Generation Firewall, and choose Log Forwarder as the transport option.
   • Adds ManageAIResponses permission so admins can manage other users' private scheduled prompts.
   • Adds ViewAIPrivateResponses permission granting view-only admins read access to private scheduled prompts without modify rights.
   • Supports managing Panther AI scheduled prompts as code via GitHub PR.
   • Supports deleting Data Models, Global Helpers, and Queries via a GitHub PR.
   • Adds a Log Forwarder transport option for ingesting Palo Alto Next-Generation Firewall logs.

   +7 more show less

   • Adds Claude Code and Claude Cowork as new log sources.
   • Adds AI auto-triage capability that can defer alert notifications until triage completes.
   • Adds Tracebit.AlertSummary log type and extends Tracebit.Alert with Google Cloud principals.
   • Adds Material.IssueChange and Material.AuditLog log types.
   • Enables signing a user out of all active sessions from the Users Management settings page.
   • Normalizes G Suite Drive document-owner email into p_any_emails for cross-source correlation.
   • Renders full markdown (bold, links, tables, and lists) in Panther AI Slack messages.
   • Adds ManageAIResponses permission so admins can manage other users' private scheduled prompts.
   • Adds ViewAIPrivateResponses permission granting view-only admins read access to private scheduled prompts without modify rights.
   • Supports managing Panther AI scheduled prompts as code via GitHub PR.
   • Adds a Log Forwarder transport option for ingesting Palo Alto Next-Generation Firewall logs.
   • Adds Claude Code and Claude Cowork as new log sources.

   +3 more show less

   • Adds AI auto-triage capability that can defer alert notifications until triage completes.
   • Adds Material.IssueChange and Material.AuditLog log types.
   • Enables signing a user out of all active sessions from the Users Management settings page.

   4 more in Everything

4. v1.128 seen Sep 7, 2026 · issue 067

   Panther v1.128 adds STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. log enrichment, Slack Bot AI Triage, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services./Terraform management for Log Forwarder sources, and a new sidebar nav.

   └──▷ USE IT
   Enable time-bounded correlation across grouped events — useful for detecting brute-force patterns that must occur within a rolling window.
   yaml copy

   WithinTimeFrameMinutes: 10

   Trigger on-demand AI triage from Slack when an alert fires, without leaving the thread.
   📍In the Panther Slack Bot alert thread: 1. Click the AI Triage button to start automated triage. 2. After triage completes, @mention the Panther bot in the thread to ask follow-up questions. 3. If the button or @mention is missing, update your Slack app manifest as described in the Panther docs.
   • Adds WithinTimeFrameMinutes option to group correlation rules for CTE-based matching.
   • Supports managing Panther Log Forwarder sources as code via the REST API and Terraform provider.
   • Adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form./TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. enrichment for ingested logs.
   • Adds an AI Triage button to the Panther Slack Bot to trigger triage on demand, plus @mention support for follow-up questions in Slack threads (requires updating your Slack app manifest).
   • Expands the Google Workspace schema with additional Activity types and new Reports API fields.

   +1 more show less

   • Updated left navigation brings a flatter structure, with settings and the user menu now built into the sidebar.
   • Supports managing Panther Log Forwarder sources as code via the REST API and Terraform provider.
   • Adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form./TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. enrichment for ingested logs.

   4 more in Everything

5. v1.129 seen Sep 7, 2026 · issue 067

   Panther v1.129 adds an Infrastructure Cost Dashboard and expands normalized event filters with enriched-field support.

   • Normalized event filters can now filter events using Panther-enriched fields.
   • Scheduled lookups now support Databricks-backed queries.

   2 more in Everything