Panther MCP Server

Add a comment to a Panther alert. Comments support Markdown formatting. Returns: Dict containing: - success: Boolean indicating if the comment was added successfully - comment: Created comment information if successful - message: Error message if unsuccessful Permissions:{'all_of': ['Manage Alerts']}

Bulk update multiple alerts with status, assignee, and/or comment changes. This tool allows you to efficiently update multiple alerts at once by setting their status, assignee, and adding a comment. At least one of status, assignee_id, or comment must be provided. Returns: Dict containing: - success: Boolean indicating overall success - results: Dict with operation results: - status_updates: List of alert IDs successfully updated with new status - assignee_updates: List of alert IDs successfully updated with new assignee - comments_added: List of alert IDs that successfully received comments - failed_operations: List of failed operations with error details - summary: Dict with counts of successful and failed operations - message: Error message if unsuccessful Permissions:{'all_of': ['Manage Alerts']}

Disable a Panther detection by setting enabled to false. Permissions:{'any_of': ['Manage Rules', 'Manage Policies']}

Retrieve the latest AI triage summary for a specific Panther alert. This tool retrieves the most recently generated AI triage analysis for an alert. It fetches the list of AI inference stream IDs associated with the alert, then retrieves the response text for the latest stream. Returns: Dict containing: - success: Boolean indicating if retrieval was successful - summary: The latest AI triage summary containing: - stream_id: The unique stream identifier - response_text: The AI-generated triage summary - finished: Whether the triage generation completed - error: Any error message if present - message: Error message if unsuccessful Permissions:{'all_of': ['Run Panther AI']}

Get detailed information about a specific Panther alert by ID Permissions:{'all_of': ['Read Alerts']}

Performs detailed actor-based analysis and prioritization in the specified time period (YYYY-MM-DD HH:MM:SSZ format).

Find detection rule errors between the specified dates (YYYY-MM-DD HH:MM:SSZ format) and perform root cause analysis.

Generates a monthly report on the health of all Panther log sources for a given month and year, and triages any unhealthy sources.

Generates a comprehensive detection quality report for analyzing alert data a given month and year to identify problematic rules and opportunities for improvement, including alerts, detection errors, and system errors.

Performs an exhaustive investigation of a specific actor’s activity, including both alerted and non-alerted events, and produces a comprehensive final report with confidence assessment.

Get the Panther configuration.