> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Panther

> Reference for the Tracecat Panther integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Bulk update Panther alerts

Action ID: `tools.panther.bulk_update_alerts`

Update multiple Panther alerts at once.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>
  List of alert IDs to update.
</ParamField>

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="assignee" type="string | null">
  User ID to assign the alerts to.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  New status for the alerts.

  Default: `null`.
</ParamField>

## Create Panther query

Action ID: `tools.panther.create_query`

Create a new saved query in Panther.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="name" type="string" required>
  Name of the saved query.
</ParamField>

<ParamField path="sql" type="string" required>
  SQL query to save. Must be valid SQL, not PantherFlow.
</ParamField>

<ParamField path="description" type="string | null">
  Description of the query.

  Default: `null`.
</ParamField>

<ParamField path="schedule" type="object | null">
  Schedule configuration for the query.

  Default: `null`.
</ParamField>

## Delete Panther query

Action ID: `tools.panther.delete_query`

Delete a saved query from Panther.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="query_id" type="string" required>
  The unique identifier of the saved query.
</ParamField>

## Execute Panther query

Action ID: `tools.panther.execute_query`

Execute a saved query in Panther.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="query_id" type="string" required>
  The unique identifier of the saved query.
</ParamField>

<ParamField path="parameters" type="object | null">
  Parameters to pass to the query.

  Default: `null`.
</ParamField>

## Get Panther alert

Action ID: `tools.panther.get_alert`

Get a single alert from Panther by ID.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

## Get Panther query

Action ID: `tools.panther.get_query`

Get a saved query from Panther by ID.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="query_id" type="string" required>
  The unique identifier of the saved query.
</ParamField>

## List Panther alerts

Action ID: `tools.panther.list_alerts`

List alerts from Panther with optional filters.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="cursor" type="string | null">
  Pagination cursor for next page.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of alerts to return.

  Default: `null`.
</ParamField>

<ParamField path="severity" type="string | null">
  Filter by alert severity.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  Filter by alert status.

  Default: `null`.
</ParamField>

## List Panther queries

Action ID: `tools.panther.list_queries`

List saved queries from Panther.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="cursor" type="string | null">
  Pagination cursor for next page.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of queries to return.

  Default: `null`.
</ParamField>

## Update Panther alert

Action ID: `tools.panther.update_alert`

Update a Panther alert's status or assignee.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="alert_id" type="string" required>
  The unique identifier of the alert.
</ParamField>

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="assignee" type="string | null">
  User ID to assign the alert to.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  New status for the alert.

  Default: `null`.
</ParamField>

## Update Panther query

Action ID: `tools.panther.update_query`

Update a saved query in Panther.

### Secrets

Required secrets:

* `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>
  Panther API URL (e.g. [https://api.runpanther.net](https://api.runpanther.net)).
</ParamField>

<ParamField path="query_id" type="string" required>
  The unique identifier of the saved query.
</ParamField>

<ParamField path="description" type="string | null">
  New description for the query.

  Default: `null`.
</ParamField>

<ParamField path="name" type="string | null">
  New name for the query.

  Default: `null`.
</ParamField>

<ParamField path="schedule" type="object | null">
  New schedule configuration for the query.

  Default: `null`.
</ParamField>

<ParamField path="sql" type="string | null">
  New SQL query. Must be valid SQL.

  Default: `null`.
</ParamField>