panther-labs/mcp-panther

Panther's Model Context Protocol (MCP) server provides functionality to:
1. **Write and tune detections from your IDE**
2. **Interactively query security logs using natural language**
3. **Triage, comment, and resolve one or many alerts**
Available Tools
Alerts
| Tool Name | Description | Sample Prompt |
|-----------|-------------|---------------|
| add_alert_comment | Add a comment to a Panther alert | "Add comment 'Looks pretty bad' to alert abc123" |
| start_ai_alert_triage | Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations | "Start AI triage for alert abc123" / "Generate a detailed AI analysis of alert def456" |
| get_ai_alert_triage_summary | Retrieve the latest AI triage summary previously generated for a specific alert | "Get the AI triage summary for alert abc123" / "Show me the AI analysis for alert def456" |
| get_alert | Get detailed information about a specific alert | "What's the status of alert 8def456?" |
| get_alert_events | Get a small sampling of events for a given alert | "Show me events associated with alert 8def456" |
| list_alerts | List alerts with comprehensive filtering options (date range, severity, status, etc.) | "Show me all high severity alerts from the last 24 hours" |
| bulk_update_alerts | Bulk update multiple alerts with status, assignee, and/or comment changes | "Update alerts abc123, def456, and ghi789 to resolved status and add comment 'Fixed'" |
| update_alert_assignee | Update the assignee of one or more alerts | "Assign alerts abc123 and def456 to John" |
| update_alert_status | Update the status of one or more alerts | "Mark alerts abc123 and def456 as resolved" |
| list_alert_comments | List all comments for a specific alert | "Show me all comments for alert abc123" |
Data Lake
| Tool Name | Description | Sample Prompt |
|-----------|-------------|---------------|
| query_data_lake | Execute SQL queries against Panther's data lake with synchronous results | "Query AWS CloudTrail logs for failed login attempts in the last day" |
| get_table_schema | Get schema information for a specific table | "Show me the schema for the AWS_CLOUDTRAIL table" |
| list_databases | List all available data lake databases in Panther | "List all available databases" |
| list_database_tables | List all available tables for a specific database in Panther's data lake | "What tables are in the panther_logs database" |
| get_alert_event_stats | Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics | "Show me patterns in events from alerts abc123 and def456" |
Scheduled Queries
| Tool Name | Description | Sample Prompt |
|-----------|-------------|---------------|
| list_scheduled_queries | List all scheduled queries with pagination support | "Show me all scheduled queries" / "List the first 25 scheduled queries" |
| get_scheduled_query | Get detailed information about a specific scheduled query by ID | "Get details for scheduled query 'weekly-security-report'" |
Sources
| Tool Name | Description | Sample Prompt |
|-----------|-------------|---------------|
| list_log_sources | List log sources with optional filters (health status, log types, integration type) | "Show me all healthy S3 log sources" |
| get_http_log_source | Get detailed information about a specific HTTP log source by ID | "Show me the configuration for HTTP source 'webhook-collector-123'" |
Detections
| Tool Name | Description | Sample Prompt |
|-----------|-------------|---------------|
| list_detections | List detections from Panther with comprehensive filtering support. Supports multiple detection types and filtering by name, state, severity, tags, log types, resource types, output IDs (destinations), and more. Returns outputIDs for each detection showing configured alert destinations | "Show me all enabled HIGH severity rules with tag 'AWS'" / "List disabled policies for S3 resources" / "Find all rules with outputID 'prod-slack'" / "Show me detections that alert to production destinations" |