Skip to main content

​
Bulk update Panther alerts

Action ID: tools.panther.bulk_update_alerts Update multiple Panther alerts at once.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
alert_ids
array[string]
required
List of alert IDs to update.
​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
assignee
string | null
User ID to assign the alerts to.Default: null.
​
status
string | null
New status for the alerts.Default: null.

​
Create Panther query

Action ID: tools.panther.create_query Create a new saved query in Panther.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
name
string
required
Name of the saved query.
​
sql
string
required
SQL query to save. Must be valid SQL, not PantherFlow.
​
description
string | null
Description of the query.Default: null.
​
schedule
object | null
Schedule configuration for the query.Default: null.

​
Delete Panther query

Action ID: tools.panther.delete_query Delete a saved query from Panther.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
query_id
string
required
The unique identifier of the saved query.

​
Execute Panther query

Action ID: tools.panther.execute_query Execute a saved query in Panther.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
query_id
string
required
The unique identifier of the saved query.
​
parameters
object | null
Parameters to pass to the query.Default: null.

​
Get Panther alert

Action ID: tools.panther.get_alert Get a single alert from Panther by ID.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
alert_id
string
required
The unique identifier of the alert.
​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).

​
Get Panther query

Action ID: tools.panther.get_query Get a saved query from Panther by ID.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
query_id
string
required
The unique identifier of the saved query.

​
List Panther alerts

Action ID: tools.panther.list_alerts List alerts from Panther with optional filters.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
cursor
string | null
Pagination cursor for next page.Default: null.
​
limit
integer | null
Maximum number of alerts to return.Default: null.
​
severity
string | null
Filter by alert severity.Default: null.
​
status
string | null
Filter by alert status.Default: null.

​
List Panther queries

Action ID: tools.panther.list_queries List saved queries from Panther.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
cursor
string | null
Pagination cursor for next page.Default: null.
​
limit
integer | null
Maximum number of queries to return.Default: null.

​
Update Panther alert

Action ID: tools.panther.update_alert Update a Panther alert’s status or assignee.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
alert_id
string
required
The unique identifier of the alert.
​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
assignee
string | null
User ID to assign the alert to.Default: null.
​
status
string | null
New status for the alert.Default: null.

​
Update Panther query

Action ID: tools.panther.update_query Update a saved query in Panther.

​
Secrets

Required secrets:
  • panther: required values PANTHER_API_KEY.

​
Input fields

​
base_url
string
required
Panther API URL (e.g. https://api.runpanther.net).
​
query_id
string
required
The unique identifier of the saved query.
​
description
string | null
New description for the query.Default: null.
​
name
string | null
New name for the query.Default: null.
​
schedule
object | null
New schedule configuration for the query.Default: null.
​
sql
string | null
New SQL query. Must be valid SQL.Default: null.