> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/integrations/data/panther_data.md).

# Panther

{% hint style="info" %}
Panther is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis.
{% endhint %}

The Dropzone platform integrates with the [Panther](https://panther.com) security SIEM. Many customers ingest other alert sources into Panther (e.g. IDPs) and integrate Dropzone into Panther rather than the source systems.

## Create an API Key

Panther requires an API key to enable.

To obtain an API Key, do the following:

* Navigate to your Panther homepage
* Click on the gear icon in the top right corner
* Select "API Tokens"

<figure><img src="/files/rMbgKWDczTARxzk3jnh4" alt=""><figcaption><p>Select API Tokens</p></figcaption></figure>

* Record the API URL located at the top of the page for use later in the Dropzone UI where it is called "Panther URL"

<figure><img src="/files/Kc1naJsLMdcCPxRn6GZU" alt=""><figcaption><p>API URL</p></figcaption></figure>

* Click on "Create New Token"
* Grant the token the following permissions:

| Permission       | Purpose                                                                      |
| ---------------- | ---------------------------------------------------------------------------- |
| Manage Alerts    | (optional) Allows Dropzone to add investigations results as Panther comments |
| Read Alerts      | Allows Access to alert information                                           |
| View Rules       | Allows viewing the log rules setup in Panther                                |
| Query Data Lake  | Allows listing and issuing Data Explorer & Indicator Search queries          |
| View Log Sources | Allows viewing the Log sources setup                                         |
| Read User Info   | Allows access to user information related to your Panther resources          |

* Click "Create API Token" at the bottom of the page

<figure><img src="/files/rVEE5HVK3ENW87OnOJHM" alt=""><figcaption><p>Create API Token</p></figcaption></figure>

* Record the value for use later in the Dropzone UI where it is called "API key"

<figure><img src="/files/QklKBnMt3jMyy18vJaX9" alt=""><figcaption><p>Record the API Token</p></figcaption></figure>

* Click "Done"

## Enable Panther

To enable the Data Source integration, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, click Settings > Integrations

<figure><img src="/files/zN02u3HObDaemUY8E1kD" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Available"

<figure><img src="/files/brI7n2Ux40Tk0jTwBCVh" alt=""><figcaption><p>Click Available</p></figcaption></figure>

* In the Search bar, search Panther, then click "Configure"

<figure><img src="/files/aIQoOqxBNgtDUIkUVV9e" alt=""><figcaption><p>The Panther Tile</p></figcaption></figure>

* Under the Data Source heading, input the Panther URL link and the API key

<figure><img src="/files/ePAheODVOZtn7DPHTQk2" alt=""><figcaption><p>The Panther Data Source Configuration</p></figcaption></figure>

* Click "Test & Save" to finish

{% hint style="info" %}
The Panther API token activation is not instantaneous. If the connection fails initially try again after a few minutes.
{% endhint %}

If you have any errors engage your Dropzone AI support representative.