MCP Panther

add_alert_comment

Add a comment to a Panther alert

start_ai_alert_triage

Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations

get_ai_alert_triage_summary

Retrieve the latest AI triage summary previously generated for a specific alert

get_alert

Get detailed information about a specific alert

get_alert_events

Get a small sampling of events for a given alert

list_alerts

List alerts with comprehensive filtering options (date range, severity, status, etc.)

bulk_update_alerts

Bulk update multiple alerts with status, assignee, and/or comment changes

update_alert_assignee

Update the assignee of one or more alerts

update_alert_status

Update the status of one or more alerts

list_alert_comments

List all comments for a specific alert

query_data_lake

Execute SQL queries against Panther's data lake with synchronous results

get_table_schema

Get schema information for a specific table

list_databases

List all available data lake databases in Panther

list_database_tables

List all available tables for a specific database in Panther's data lake

get_alert_event_stats

Analyze patterns and relationships across multiple alerts by aggregating their event data into time-based statistics

list_scheduled_queries

List all scheduled queries with pagination support

get_scheduled_query

Get detailed information about a specific scheduled query by ID

list_log_sources

List log sources with optional filters (health status, log types, integration type)

get_http_log_source

Get detailed information about a specific HTTP log source by ID

list_detections

List detections from Panther with comprehensive filtering support.

get_detection

Get detailed information about a specific detection including the detection body and tests.

disable_detection

Disable a detection by setting enabled to false.

list_global_helpers

List global helper functions with comprehensive filtering options (name search, creator, modifier)

get_global_helper

Get detailed information and complete Python code for a specific global helper

list_data_models

List data models that control UDM mappings in rules

get_data_model

Get detailed information about a specific data model

list_log_type_schemas

List available log type schemas with optional filters

get_log_type_schema_details

Get detailed information for specific log type schemas

get_rule_alert_metrics

Get metrics about alerts grouped by rule

get_severity_alert_metrics

Get metrics about alerts grouped by severity

get_bytes_processed_metrics

Get data ingestion metrics by log type and source

list_users

List all Panther user accounts with pagination support

get_user

Get detailed information about a specific user

get_permissions

Get the current user's permissions

list_roles

List all roles with filtering options (name search, role IDs, sort direction)

get_role

Get detailed information about a specific role including permissions