{
 "categories": [
  "devsecops"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-10-13",
   "fact": "homepage",
   "note": "The Panther homepage title is Panther, The Complete AI SOC Platform.",
   "source": "https://www.panther.com/",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "deployment",
   "note": "API tokens and the API Playground are part of the Panther Console. A self-hosted deployment page was not opened.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "platforms",
   "note": "Tokens are created in the Panther Console, a web application.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "license",
   "note": "The opened pages document Panther's vendor console and APIs. An open-source license or a free-plan page was not opened, so the license is recorded as commercial.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.api.exists",
   "note": "Panther documents a REST API and a GraphQL-over-HTTP API.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.api.kinds[0]",
   "note": "The page lists REST operations for alerts, rules, log sources, users, and other entities.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.api.kinds[1]",
   "note": "The page lists a GraphQL-over-HTTP API for alerts, data-lake queries, log sources, and users.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.api.auth[0]",
   "note": "An API token is created in the Console and sent in the X-API-Key header. Permissions and an optional CIDR allow list are set on the token.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.api.coverage",
   "note": "The overview lists many REST and GraphQL entity groups and says the operation set is still growing, so coverage is partial.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.api.docs",
   "note": "Opened as the current Panther API overview.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.mcp.first_party",
   "note": "The panther-labs/mcp-panther README documents Panther's MCP server for alerts, detections, and data-lake queries.",
   "source": "https://raw.githubusercontent.com/panther-labs/mcp-panther/main/README.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "modalities.mcp.verdict",
   "note": "The server is published by panther-labs, Panther's GitHub organization, so the verdict is official.",
   "source": "https://raw.githubusercontent.com/panther-labs/mcp-panther/main/README.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "verdict.scores.api",
   "note": "Documented REST and GraphQL APIs with permissioned API tokens and self-rotation. The page says the operation set is still growing. Score 8.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "verdict.scores.mcp",
   "note": "Official local MCP server for alerts, data-lake SQL, and detection reads and disables. Detection authoring was not in the opened tool tables. Score 7.",
   "source": "https://raw.githubusercontent.com/panther-labs/mcp-panther/main/README.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "freshness.watch[0].url",
   "note": "Opened as the current Panther API overview.",
   "source": "https://docs.panther.com/panther-developer-workflows/api",
   "tier": "declared"
  },
  {
   "date": "2026-10-13",
   "fact": "freshness.watch[1].url",
   "note": "Opened as the current Panther MCP server README.",
   "source": "https://raw.githubusercontent.com/panther-labs/mcp-panther/main/README.md",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-10-13",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://docs.panther.com/panther-developer-workflows/api"
   },
   {
    "type": "mcp",
    "url": "https://raw.githubusercontent.com/panther-labs/mcp-panther/main/README.md"
   }
  ]
 },
 "homepage": "https://www.panther.com/",
 "id": "panther",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": "unknown"
  },
  "api": {
   "auth": [
    "api-token"
   ],
   "coverage": "partial",
   "docs": "https://docs.panther.com/panther-developer-workflows/api",
   "exists": true,
   "kinds": [
    "rest",
    "graphql"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Panther documents REST and GraphQL APIs and a first-party MCP server for alerts, detections, and data-lake queries.\n",
   "ui_stack": [],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Panther",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "splunk",
   "sumo-logic"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Panther",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": 7,
   "overall": 8,
   "rpa": null
  },
  "summary": "Panther is automatable today through its REST and GraphQL APIs. This record is the Panther SIEM. The Panther API page says Panther offers a REST API and a GraphQL-over-HTTP API, explored from the API Playground in the Panther Console. Tokens are created under Settings, Developer Tools, API Tokens, with selected permissions and an optional IP allow list in CIDR notation. The Playground sends the token in the X-API-Key header. A token can rotate itself with POST api-tokens/self/rotate, and the previous token stops working. The REST list on that page includes alerts, alert comments, API tokens, cloud accounts, data models, globals, log sources, queries, roles, rules, scheduled rules, simple rules, policies, and users. The GraphQL list includes alerts, cloud accounts, data-lake queries, log sources, metrics, token rotation, and users. panther-labs/mcp-panther documents a local MCP server that uses PANTHER_INSTANCE_URL and PANTHER_API_TOKEN. The README tool tables cover alert triage and updates, data-lake SQL, log sources, detection listing and disabling, schemas, and metrics. The documented installs are the ghcr.io/panther-labs/mcp-panther image and uvx mcp-panther. Creating a detection was not in the opened tool tables. A separate PAT command-line guide was not opened. The homepage statement that Panther is moving into Databricks Lakewatch was not re-opened, so this record does not treat the products as merged. Connector catalogs were not opened. Computer-use viability is unassessed. API scores 8. MCP scores 7. API is the best path because a scoped token calls REST and GraphQL directly, without a local MCP process, and the opened MCP tools do not show detection authoring.\n"
 }
}