https://cybertoolchain.io/tools/panther New releases and features in Panther, tracked by The Cyber Toolchain. en Mon, 07 Sep 2026 07:32:59 GMT https://panther.com/releases https://panther.com/releases Mon, 07 Sep 2026 07:32:59 GMT Panther v1.129 adds an Infrastructure Cost Dashboard to track usage and billing trends. • Adds an Infrastructure Cost Dashboard that tracks Panther usage and billing trends. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/panther https://panther.com/releases/v1-126 https://panther.com/releases/v1-126 Mon, 07 Sep 2026 07:32:55 GMT Panther v1.126 adds Cursor audit logs, Palo Alto NGFW log source, Log Forwarder for on-prem, and a redesigned Settings page. • Adds a new `Panther Log Forwarder` source to send on-prem logs to Panther. • Adds ingestion of Cursor audit logs over an HTTP webhook for visibility into Cursor platform activity. • Adds a new log source for Palo Alto Next-Generation Firewall logs to bring on-prem firewall activity into Panther. • Redesigned Settings page consolidates all configuration into a single full-page view with a persistent sidebar. • Enables creation of GitHub PRs for data models, global helpers, and deletions. • Adds Identity Threat Protection fields to the `Okta.SystemLog` schema. • Schemas page now hides archived schemas by default, with a `Status` filter to show them. • Enrichment and custom enrichment uploads now surface actionable errors for duplicate keys and invalid files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/panther https://panther.com/releases/v1-127 https://panther.com/releases/v1-127 Mon, 07 Sep 2026 07:32:55 GMT Panther v1.127 adds Claude Code/Cowork log sources, AI auto-triage deferral, Log Forwarder for Palo Alto NGFW, and new admin RBAC for AI scheduled prompts. • Adds `ManageAIResponses` permission so admins can manage other users' private scheduled prompts. • Adds `ViewAIPrivateResponses` permission granting view-only admins read access to private scheduled prompts without modify rights. • Supports managing Panther AI scheduled prompts as code via GitHub PR. • Supports deleting Data Models, Global Helpers, and Queries via a GitHub PR. • Adds a Log Forwarder transport option for ingesting Palo Alto Next-Generation Firewall logs. • Adds Claude Code and Claude Cowork as new log sources. • Adds AI auto-triage capability that can defer alert notifications until triage completes. • Adds `Tracebit.AlertSummary` log type and extends `Tracebit.Alert` with Google Cloud principals. • Adds `Material.IssueChange` and `Material.AuditLog` log types. • Enables signing a user out of all active sessions from the Users Management settings page. • Normalizes G Suite Drive document-owner email into `p_any_emails` for cross-source correlation. • Renders full markdown (bold, links, tables, and lists) in Panther AI Slack messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/panther https://panther.com/releases/v1-128 https://panther.com/releases/v1-128 Mon, 07 Sep 2026 07:32:55 GMT Panther v1.128 adds STIX/TAXII log enrichment, Slack Bot AI Triage, REST API/Terraform management for Log Forwarder sources, and a new sidebar nav. • Adds `WithinTimeFrameMinutes` option to group correlation rules for CTE-based matching. • Supports managing Panther Log Forwarder sources as code via the REST API and Terraform provider. • Adds STIX/TAXII enrichment for ingested logs. • Adds an 'AI Triage' button to the Panther Slack Bot to trigger triage on demand, plus `@mention` support for follow-up questions in Slack threads (requires updating your Slack app manifest). • Expands the Google Workspace schema with additional Activity types and new Reports API fields. • Updated left navigation brings a flatter structure, with settings and the user menu now built into the sidebar. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/panther https://panther.com/releases/v1-129 https://panther.com/releases/v1-129 Mon, 07 Sep 2026 07:32:55 GMT Panther v1.129 adds an Infrastructure Cost Dashboard and expands normalized event filters with enriched-field support. • Normalized event filters can now filter events using Panther-enriched fields. • Scheduled lookups now support Databricks-backed queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/panther