# Panther

{% hint style="info" %}
Panther is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis.
{% endhint %}

The Dropzone platform integrates with the [Panther](https://panther.com) security SIEM. Many customers ingest other alert sources into Panther (e.g. IDPs) and integrate Dropzone into Panther rather than the source systems.

## Create an API Key

Panther requires an API key to enable.

To obtain an API Key, do the following:

* Navigate to your Panther homepage
* Click on the gear icon in the top right corner
* Select "API Tokens"

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-2cfdf081d0fc790f1d704b4c868dcf2e482517af%2Fpanther-api-1.png?alt=media" alt=""><figcaption><p>Select API Tokens</p></figcaption></figure>

* Record the API URL located at the top of the page for use later in the Dropzone UI where it is called "Panther URL"

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-0300887b70e0604e06886bf99999ce7672b31f84%2Fpanther-api-2.png?alt=media" alt=""><figcaption><p>API URL</p></figcaption></figure>

* Click on "Create New Token"
* Grant the token the following permissions:

| Permission       | Purpose                                                                      |
| ---------------- | ---------------------------------------------------------------------------- |
| Manage Alerts    | (optional) Allows Dropzone to add investigations results as Panther comments |
| Read Alerts      | Allows Access to alert information                                           |
| View Rules       | Allows viewing the log rules setup in Panther                                |
| Query Data Lake  | Allows listing and issuing Data Explorer & Indicator Search queries          |
| View Log Sources | Allows viewing the Log sources setup                                         |
| Read User Info   | Allows access to user information related to your Panther resources          |

* Click "Create API Token" at the bottom of the page

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-56fb67a4b3438a0ee2a05e8e7e8a269db50c2cf8%2Fpanther-api-4.png?alt=media" alt=""><figcaption><p>Create API Token</p></figcaption></figure>

* Record the value for use later in the Dropzone UI where it is called "API key"

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-8b110f04d487581c0a5e3465c77b462b5a8e2a74%2Fpanther-api-5.png?alt=media" alt=""><figcaption><p>Record the API Token</p></figcaption></figure>

{% hint style="danger" %}
This value is not shown after you leave this page — be sure to record it immediately.
{% endhint %}

* Click "Done"

## Enable The Dropzone Alert Source Integration

To enable the Alert Source integration, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-b3f07f902b1402dadc7abbd8bb62f9c204547390%2Fui-integrations-dropdown.png?alt=media" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Available"

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-434641ec6d4e45051842f86164f485d6bd289424%2Fapp_system_integrations_available.png?alt=media" alt=""><figcaption><p>Click Available</p></figcaption></figure>

* In the Search bar, search Panther, then click "Configure"

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-88e5b6f1131b6da795101077eda5a921568b2435%2Fapp_system_integrations_available_Panther.png?alt=media" alt=""><figcaption><p>The Panther Tile</p></figcaption></figure>

* Under the Alert Source heading, input the Panther URL and the API key

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-305c8477bf09aaf48911399e12168248e4ad856f%2Fapp_system_integrations_available_panther_alert_config_1.png?alt=media" alt=""><figcaption><p>The Panther Alert Source Configuration (pt 1)</p></figcaption></figure>

* In the "Enabled alert statuses for ingestion" section, check the alert [statuses](https://docs.panther.com/alerts/alert-management) you want Dropzone to be able to investigate

{% hint style="info" %}
The "Closed" status in the Dropzone UI is shown as "Invalid" in the Panther UI.
{% endhint %}

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-f9708830b26de8788085eedf21e6b6df15660d91%2Fapp_system_integrations_available_panther_alert_config_2.png?alt=media" alt=""><figcaption><p>The Panther Alert Source Configuration (pt 2)</p></figcaption></figure>

* Check the severity levels you want to ingest

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-ef1636fd92c1e82c847b4f3460e1e464288afd8b%2Fapp_system_integrations_available_panther_alert_config_3.png?alt=media" alt=""><figcaption><p>The Panther Alert Source Configuration (pt 3)</p></figcaption></figure>

* Select a duration in minutes for alert deduplication. See the [Panther alert deduplication](https://docs.panther.com/detections/rules#deduplication-of-alerts) documentation for more info. A value of 15 is reasonable
* If you wish, you may use an alert filter by setting "Detection ID regex filter"
  * When a regex is put in this field Dropzone will only ingest alerts whose origin ID matches the regular expression
  * Example origin IDS: `AWS.Root.Activity`, `Okta.AdminRoleAssigned`, `GCP.GKE.Kubernetes.Cron.Job.Created.Or.Modified`
  * Supports [Python regular expression syntax](https://docs.python.org/3/library/re.html)
    * For example, to ingest all alerts *other* than AWS alerts, you could use `^(?!AWS).*`
  * Work with your Dropzone technical resource to determine if this is appropriate

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-a7639253a927407a88a28d62bdb7c39c9ba1eae5%2Fapp_system_integrations_available_panther_alert_config_4.png?alt=media" alt=""><figcaption><p>The Panther Alert Source Configuration (pt 4)</p></figcaption></figure>

* In the "Ticket Sync" section, check the boxes to choose what comments you wish to be included with each ticket

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-2cf5354e02f335560c0729c6625152ffc026d2c5%2Fapp_system_integrations_available_panther_alert_config_5.png?alt=media" alt=""><figcaption><p>The Panther Alert Source Configuration (pt 5)</p></figcaption></figure>

* Click "Test & Save" to finish

{% hint style="info" %}
The Panther API token activation is not instantaneous. If the connection fails initially, try again after a few minutes.
{% endhint %}

If you have any errors engage your Dropzone AI support representative.