Skip to main content

Panther

Forward audit logs to Panther via an HTTP log source, so your audit trail is searchable in Panther and available to detections.

Panther ingests logs through a per-source HTTPS endpoint (a webhook). You create the HTTP log source in the Panther Console, choose an authentication method, and paste the resulting URL and credential into Willow. This is the correct path for streaming log data — the Panther management API is for managing rules, alerts, and sources, not for sending log events.

Prerequisites​

  1. A Panther Console you can create log sources in.
  2. An HTTP log source created in Panther. Note its HTTP Source URL from the setup success screen.
  3. The authentication credential you configured on that source (a Bearer token or a shared-secret header value).
  4. Network egress allowed from your deployment to the Panther HTTP Source URL on port 443.

Create the HTTP log source in Panther​

  1. In the Panther Console, go to Log Sources > Create New > HTTP.
  2. Give the source a name. You can attach a schema now or let Panther infer one from the first events it receives.
  3. Under Select Authentication Type, choose an Auth method:
    • Bearer — enter a token value (do not include the word "Bearer"). Willow sends it as Authorization: Bearer <token>.
    • Shared Secret — enter a Header Name and generate a Shared Secret Value. Willow sends that header with that value on every request.
  4. Securely copy the token/secret — Panther shows it only once.
  5. Select Setup, then copy the HTTP Source URL from the success screen.

Configuration fields​

FieldRequiredDescription
HTTP Source URLYesThe URL shown when you created the HTTP log source in the Panther Console. Willow POSTs each audit log to this endpoint.
AuthenticationYesMust match the auth method configured on the Panther source: Bearer, Shared Secret, or None. Defaults to Bearer.
Bearer TokenIf BearerThe token value (without the word "Bearer"). Sent as Authorization: Bearer <token>.
Header NameIf Shared SecretThe custom header name configured on the source (e.g., x-api-key).
Shared SecretIf Shared SecretThe shared-secret value for that header.
Anonymous ModeNoToggle to send only statistical data (see Anonymous Mode).

How it works​

Each audit log is POSTed to your HTTP Source URL as a JSON object, with Content-Type: application/json. Panther infers the schema from the posted JSON, so the audit log record is sent directly as the request body:

{
  "id": "…",
  "org_id": "org_123",
  "action": "tool_call",
  "created_at": "2024-01-15T10:30:00.000Z",
  "user": { "id": "…", "name": "…", "email": "…" },
  "data": { "…": "…" }
}

The auth header depends on the method you chose: Bearer sends Authorization: Bearer <token>; Shared Secret sends your configured header name and value; None sends no auth header. In non-anonymous mode the payload includes the user object; in anonymous mode the user object and data payload are omitted. The request timeout is 5 seconds.

You do not have to define a schema — Panther can infer one from the events it receives. But attaching a defined schema gives you typed, named columns, extracts identity fields (like the actor email) as searchable indicators, and makes detections and correlation reliable instead of dependent on inferred types.

Download the schema: willow-panther-schema.yaml

It defines a Custom.WillowAuditLog schema whose fields match Willow's audit log:

  • The always-present envelope — id, org_id, action, and created_at (marked isEventTime) — plus user (with user.email extracted as an email indicator).
  • The flat analytics columns Willow denormalizes (tool_call_mcp, tool_call_tool, tool_call_success, guard_check_scope, token_count_*, performance_total_time, and more), so most detections never have to reach into data.
  • data is kept as json because its shape depends on action. Every non-envelope field is optional, so Anonymous Mode events (which omit user and data) still validate.

Attach it in Panther​

  1. In the Panther Console, open your HTTP log source, then select Attach or Infer Schemas.
  2. Create a new schema, paste the contents of willow-panther-schema.yaml, and save it.
  3. Attach the Custom.WillowAuditLog schema to the source.

You can also manage the schema through a CI/CD pipeline with the Panther Analysis Tool or Terraform.

Tips​

  • Panther's HTTP endpoints are always HTTPS. Include the full URL exactly as shown on the source's success screen.
  • Panther's maximum payload size is 1 MB per request (including headers).
  • Use the Test button on the log provider to send a sample event, then confirm it lands in Panther via Search or Data Explorer.
  • Leave Panther's Trigger an alert when no events are processed setting enabled so you are notified if the audit-log stream stops.

Troubleshooting​

  • 401 / 403 responses: the auth method or credential in Willow does not match the Panther source. Re-check the method (Bearer vs Shared Secret), the header name, and the token/secret value.
  • 404 responses: confirm the HTTP Source URL is copied exactly from the source's success screen, with no trailing path removed or added.
  • Nothing in Search: it can take a few minutes for a newly created source to become active. Confirm outbound egress on port 443 is allowed and that a schema is attached or being inferred.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

On this page