Panther MCP Server
Panther's Model Context Protocol (MCP) server provides functionality to:
- Write and tune detections from your IDE
- Interactively query security logs using natural language
- Triage, comment, and resolve one or many alerts
Available Tools
Alerts
| Tool Name | Description | Sample Prompt |
|---|---|---|
add_alert_comment |
Add a comment to a Panther alert | "Add comment 'Looks pretty bad' to alert abc123" |
start_ai_alert_triage |
Start an AI-powered triage analysis for a Panther alert with intelligent insights and recommendations | "Start AI triage for alert abc123" / "Generate a detailed AI analysis of alert def456" |
get_ai_alert_triage_summary |
Retrieve the latest AI triage summary previously generated for a specific alert | "Get the AI triage summary for alert abc123" / "Show me the AI analysis for alert def456" |
get_alert |
Get detailed information about a specific alert | "What's the status of alert 8def456?" |
get_alert_events |
Get a small sampling of events for a given alert | "Show me events associated with alert 8def456" |
list_alerts |
List alerts with comprehensive filtering options (date range, severity, status, etc.) | "Show me all high severity alerts from the last 24 hours" |
bulk_update_alerts |
Bulk update multiple alerts with status, assignee, and/or comment changes | "Update alerts abc123, def456, and ghi789 to resolved status and add comment 'Fixed'" |
update_alert_assignee |
Update the assignee of one or more alerts | "Assign alerts abc123 and def456 to John" |
update_alert_status |
Update the status of one or more alerts | "Mark alerts abc123 and def456 as resolved" |
list_alert_comments |
List all comments for a specific alert | "Show me all comments for alert abc123" |
