Can AI agents automate Panther?

Panther is automatable today through its REST and GraphQL APIs. This record is the Panther SIEM. The Panther API page says Panther offers a REST API and a GraphQL-over-HTTP API, explored from the API Playground in the Panther Console. Tokens are created under Settings, Developer Tools, API Tokens, with selected permissions and an optional IP allow list in CIDR notation. The Playground sends the token in the X-API-Key header. A token can rotate itself with POST api-tokens/self/rotate, and the previous token stops working. The REST list on that page includes alerts, alert comments, API tokens, cloud accounts, data models, globals, log sources, queries, roles, rules, scheduled rules, simple rules, policies, and users. The GraphQL list includes alerts, cloud accounts, data-lake queries, log sources, metrics, token rotation, and users. panther-labs/mcp-panther documents a local MCP server that uses PANTHER_INSTANCE_URL and PANTHER_API_TOKEN. The README tool tables cover alert triage and updates, data-lake SQL, log sources, detection listing and disabling, schemas, and metrics. The documented installs are the ghcr.io/panther-labs/mcp-panther image and uvx mcp-panther. Creating a detection was not in the opened tool tables. A separate PAT command-line guide was not opened. The homepage statement that Panther is moving into Databricks Lakewatch was not re-opened, so this record does not treat the products as merged. Connector catalogs were not opened. Computer-use viability is unassessed. API scores 8. MCP scores 7. API is the best path because a scoped token calls REST and GraphQL directly, without a local MCP process, and the opened MCP tools do not show detection authoring.

Best path today: api · Overall automatability: 8/10