Panther

• New alertRuns when a detection raises an alert in Panther, or only alerts of the severity you choose or higher, or from one detection. Alerts raised before the workflow was turned on don't start it.
• New high or critical alertRuns when Panther raises a High or Critical alert, such as to page whoever is on call. Alerts raised before the workflow was turned on don't start it.
• Alert status changedRuns when an alert raised in the last week is marked Triaged, Resolved or Invalid, or only the status you choose. Changes made before the workflow was turned on don't start it.
• Alert assignedRuns when an alert raised in the last week is assigned or reassigned to someone, or only to the person you choose. Assignments made before the workflow was turned on don't start it.
• New detection errorRuns when a detection's code fails on an event and Panther raises a detection error. Errors raised before the workflow was turned on don't start it.
• New system errorRuns when Panther raises a system error, such as a problem bringing in a log source's data. Errors raised before the workflow was turned on don't start it.
• Log source stopped sending logsRuns once when a log source has sent Panther nothing for the time you choose, and again if it starts and then stops once more. Sources already quiet when the workflow is turned on don't start it.
• New log sourceRuns when a log source is added to Panther, with its type and log types. Sources there when the workflow is turned on don't start it.
• New userRuns when someone is added to Panther, with their email and role, such as for an access review. People there when the workflow is turned on don't start it.
• Scheduled query finishedRuns when a scheduled query finishes in Panther, or only the query you choose, with up to 100 of its rows. Runs that finished before the workflow was turned on don't start it.

• List alertsList alerts by status, severity, when they were created, detection, title or assignee, newest first. Without dates, Panther lists the last 30 days.
• Get alertGet an alert's details: its title, severity, status, detection, assignee, runbook and alert context.
• Update alertChange an alert's status, rate its quality as Useful or Noise, or add context tags. Fields left blank keep what the alert has; tags are added to its own.
• Assign alertAssign an alert to someone in Panther, picked from the list or named by their email.
• Unassign alertTake an alert's assignee off it, so it shows as unassigned.
• Add alert commentAdd a comment to an alert, shown in its activity in Panther.
• List alert commentsList an alert's comments with who wrote each and when.
• List alert eventsList the log events behind an alert, as Panther stored them.
• List detectionsList rules, scheduled rules, simple rules, correlation rules or policies, by whether they're on, severity, name or tag.
• Get detectionGet a detection's details: whether it's on, its severity, description, runbook, tags and log types.
• Turn detection on or offTurn a detection on or off. Everything else about it stays as it is; a detection already that way is left alone.
• Run queryRun a SQL query over your logs in Panther's data lake and wait up to 5 minutes for the rows. For a longer query, use 'Start query' and 'Get query results'.
• Start queryStart a SQL query over your logs and carry on at once. Give its query ID to 'Get query results' for the rows.
• Get query resultsGet the rows of a query started earlier, waiting while it runs, or the next page of a finished query's rows.
• Search logs for indicatorsSearch every log for IP addresses, domains, emails, hashes or other indicators over a period, and wait up to 5 minutes for the matching rows.
• List saved queriesList the queries saved in Panther, with their SQL and schedules.
• Create saved querySave a SQL query in Panther under a name, for people to run in the console and workflows to run with 'Run saved query'.
• Run saved queryRun a saved query and wait up to 5 minutes for its rows.
• Delete saved queryDelete a saved query from Panther. This can't be undone.
• List log sourcesList the log sources sending data to Panther, with whether each is healthy and when it last sent logs.
• Get log sourceGet a log source's health, its log types and when it last sent logs.
• List usersList the people who use Panther, with their roles and when they last signed in.
• List rolesList Panther's roles and the permissions each gives.
• Get metricsGet how many alerts there were by severity and detection, and how many log events and bytes Panther processed by log type, over a period.

No actions match that.