---
url: https://docs.realmsec.info/integration/panther.md
---

# Panther SIEM Integration

![Panther Architecture](../images/panther_http_outputfeed.png)

### Send Logs to Panther SIEM

This guide walks you through connecting Realm to [Panther](https://panther.com/) as a destination. Realm forwards your log data to Panther using an HTTP log source, where Panther ingests, parses, and makes the data available for detection and investigation.

> **Note:** If you prefer not to use an HTTP source — for example, for high-volume sources where the 1 MB payload limit may be a concern — Panther also supports ingestion via [AWS S3](https://docs.panther.com/data-onboarding/data-transports/aws/s3) and [Google Cloud Storage](https://docs.panther.com/data-onboarding/data-transports/google/cloud-storage). In that case, configure an AWS S3 or GCS destination in Realm instead of the HTTP destination described below.

***

## 1. Create an HTTP Log Source in Panther

1. Log in to the Panther Console.
2. In the left-hand navigation bar, click **Configure > Log Sources**.
   ![Panther sidebar navigation to Log Sources](../images/panther_http_sidebar.png)
3. In the upper-right corner, click **Create New**.
4. Click the **HTTP** tile.
   ![Create a new HTTP log source](../images/panther_http_create_logsource.png)
5. In the **Basic Information** section, enter a **Source Name** (e.g., `Realm.Security`).
6. Optionally select one or more **Schemas** for the log types this source will ingest. You can also attach schemas after creation.
7. In the **Select Authentication Type** section, choose **Bearer** from the **Auth method** dropdown.
8. Enter a **Bearer Token** value.
   > **Important:** Store this token value securely — it will not be visible in the Panther Console after setup.
   > ![HTTP log source configuration options](../images/panther_http_logsource_options.png)
9. Click **Setup**.
10. On the success screen, copy the **HTTP Source URL** — Realm will send `POST` requests to this endpoint. Endpoint creation may take a few minutes.

***

## 2. Configure the Panther Destination in Realm

1. Navigate to the **Destinations** page in Realm and create a new destination for Panther.
2. Add a new **Output Feed** and configure the following fields:
   > **Name:** `Panther`\
   > **Method:** `HTTP`\
   > **Endpoint:** `<your Panther HTTP Source URL>`\
   > **Bearer Token:** `<your Panther Bearer Token>`\
   > **Compression:** `GZIP` or `ZSTD`
3. Choose your preferred **Compression** format — Panther supports both GZIP and ZSTD compressed payloads.
4. Save the Output Feed. Realm will begin forwarding log data to your Panther HTTP source.

> **Note:** For more information on Panther HTTP sources, refer to the [Panther HTTP Source documentation](https://docs.panther.com/data-onboarding/data-transports/http).

***

## 3. Send Logs to Panther via AWS S3

With this method, Realm writes log data as compressed objects into an S3 bucket in your own AWS account. That bucket notifies Panther (via SNS/SQS) whenever new objects arrive, and Panther pulls and processes them from there. This avoids the HTTP method's 1 MB payload limit and is generally preferred for high-volume sources.

> **Note:** If you're a Panther Cloud Connected customer, create this S3 bucket in a separate AWS account from the one your Panther deployment resides in.

### 3.1 Create the S3 Bucket

1. Go to **S3 > Buckets**.
2. Click **Create bucket**.
3. Enter the bucket name:
   > **Bucket name:** `rlm-demo-output`
4. Click **Create bucket**.
5. Copy the bucket name — you will need it for both the Panther and Realm configuration steps below.
   > **Note:** Versioning is disabled by default.

### 3.2 Create an S3 Log Source in Panther

1. In the Panther Console, go to **Log Sources > Create New**.
2. Click the **AWS S3 Bucket** tile.
3. Fill in:
   > **Name:** A descriptive name (e.g., `Realm Security`)\
   > **AWS Account ID:** The 12-digit account ID where your bucket lives\
   > **Bucket Name:** The bucket from Step 3.1\
   > **KMS Key ARN** *(optional)*: Only if the bucket uses KMS-SSE encryption
4. Optionally configure prefixes/schemas, then click **Setup**.
5. On the **Create IAM Role** page, choose an option:
   * **Using the AWS Console UI** — recommended if this is your first Panther S3 source. Panther launches a CloudFormation stack for you; copy the resulting **Role ARN** back into Panther.
   * **CloudFormation or Terraform File** — download Panther's provided template, deploy it in your own IaC pipeline, and provide the resulting Role ARN.
   * **I want to set up everything on my own** — create the IAM role and trust policy manually. If you choose this option, you must also complete [Step 3.3](#_3-3-configure-bucket-notifications-manual-iam-setup-only) below, since Panther can't auto-configure bucket notifications without the CloudFormation-managed role.
6. Click **Setup**, then confirm no permission errors are shown.
7. Attach a schema to the source (or configure custom schema inference later).

This IAM role is what lets **Panther read** from the bucket — it's separate from the credentials Realm uses to **write** to it, configured in Step 3.4 below.

### 3.3 Configure Bucket Notifications (Manual IAM Setup Only)

Skip this step if you used the CloudFormation/Console UI option above — it's handled for you. If you set up the IAM role manually, you need to wire up notifications yourself:

1. Create (or reuse) an SNS topic in the same region as your bucket, subscribed to Panther's input data queue. Panther's own [S3 source documentation](https://docs.panther.com/data-onboarding/data-transports/aws/s3) has the full CloudFormation template and manual steps for this — the short version: create the topic, grant Panther's account `sns:Subscribe` on it, and subscribe it to Panther's `panther-input-data-notifications-queue` SQS queue (with **raw message delivery disabled**).
2. On the bucket itself, go to **Properties > Event notifications > Create event notification**:
   > **Event name:** `PantherEventNotifications`\
   > **Event types:** `All object create events`\
   > **Destination:** SNS topic → the topic from the previous step

### 3.4 Grant Realm Write Access to the Bucket

#### Create the IAM Policy

1. Go to **IAM > Policies**.
2. Click **Create policy**.
3. Click **JSON** and replace the contents with the following, substituting `<BUCKET_NAME>` with the bucket name from Step 3.1:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3WriteRealmBucket",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:ListBucket",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        }
    ]
}
```

4. Click **Next**.
5. Enter the policy details:
   > **Name:** `rlm-s3-output-write`\
   > **Description:** Grant Realm write access to the S3 output bucket.
6. Click **Create policy**.

#### Create the IAM User

1. Go to **IAM > Users** and click **Create user**.
2. Enter the username:
   > **Name:** `<tenant_name>-realm.security-s3-output`
3. Click **Next**.
4. Select **Attach policies directly**.
5. Search for and select the `rlm-s3-output-write` policy created above.
6. Click **Next**, then **Create user**.
7. Open the user that was just created.
8. Go to **Security credentials** and click **Create access key**.
9. Select **Third-party service**, check the confirmation checkbox, then click **Next**.
10. Enter a description:
    > `Allows <tenant_name> to write to <bucket_name> S3 bucket`
11. Click **Create access key**.
12. Copy and save the **Access Key** and **Secret access key** — you will need these in the next step.

### 3.5 Configure the S3 Destination in Realm

1. Navigate to the **Destinations** page in Realm and create a new destination for Panther.
2. Under **Destinations**, select **Add New Destination** and connect the relevant log source(s) you want delivered to Panther.
3. Go to **Output Feeds > Add Output Feed**, choose the **S3** output feed type, and configure:
   > **Name:** `Panther (S3)`\
   > **Bucket Name:** The bucket from Step 3.1\
   > **Access Key** / **Secret Access Key:** From Step 3.4\
   > **Key Prefix** *(optional)*: See below\
   > **Format:** `RAW` or `JSON`
4. Save the Output Feed.

#### Output File Structure

By default, data is stored in the following path structure:

```
s3://{bucket_name}/{destination_name}/{source_name}/YYYY/MM/DD/*.log.gz
```

To use a custom prefix, set **Key Prefix** on the output feed. For example, `foo` produces:

```
s3://{bucket_name}/foo/*.log.gz
```

You can include date components using `%Y`, `%m`, and `%d`:

| Key Prefix | Resulting path |
|---|---|
| `foo/year=%Y/month=%m/day=%d/` | `s3://{bucket_name}/foo/year=2025/month=10/day=23/` |
| `foo/%Y/%m/%d/` | `s3://{bucket_name}/foo/2025/10/23/` |

Each file is compressed with `zstd` and contains newline-delimited events.

> **Note:** If you set a **Key Prefix** here, and Panther's S3 source (Step 3.2) was configured with a matching or wildcard prefix filter, double check the two agree — otherwise Panther's ingestion won't see the objects Realm writes. Also confirm the IAM role granted to Panther in Step 3.2 can actually read objects at this path (`s3:GetObject` on `arn:aws:s3:::<BUCKET_NAME>/<your-prefix>/*`), since Realm's write access (Step 3.4) and Panther's read access (Step 3.2) are configured as two entirely separate IAM principals against the same bucket.

***

## 4. Send Logs to Panther via Google Cloud Storage

This method works the same way as S3, but uses a GCS bucket and Pub/Sub notifications instead of S3 and SNS/SQS. Realm writes log objects into a GCS bucket in your own GCP project; Panther is notified of new objects via a Pub/Sub subscription and pulls them from there.

### 4.1 Create the GCS Bucket

1. Log in to the GCS console.
2. Navigate to **Cloud Storage > Buckets > Create Bucket**.
3. Enter a name for the bucket, for example: `Realm-Archive`.
4. Select **Standard** storage.
5. Click **Create**.
6. Review the bucket configuration.

### 4.2 Set Up Pub/Sub Notifications

1. Create a Pub/Sub topic for bucket notifications:
   ```
   gcloud pubsub topics create $TOPIC_ID
   ```
2. Configure the bucket to publish `OBJECT_FINALIZE` events to that topic:
   ```
   gsutil notification create -t $TOPIC_NAME -e OBJECT_FINALIZE -f json gs://$BUCKET_NAME
   ```
3. Create a subscription on that topic for Panther to consume from. This subscription must be dedicated to Panther — don't share it with any other service:
   ```
   gcloud pubsub subscriptions create $SUBSCRIPTION_ID --topic $TOPIC_ID --topic-project $PROJECT_ID
   ```

### 4.3 Create a GCS Log Source in Panther

1. In the Panther Console, go to **Log Sources > Create New**, then click the **Google Cloud Storage** tile.
2. Fill in a **Name**, and optionally configure prefixes/schemas, then click **Setup**.
3. On the **Log Format** page, select the stream type of the incoming logs (**Auto**, **Lines**, **JSON**, or **JSON Array**), then click **Continue**.
4. Choose an authentication method and follow Panther's setup for that path:
   * **Service account**: enable the IAM API, create a service account, grant it `roles/storage.objectViewer` on the bucket and `roles/pubsub.subscriber` + `roles/pubsub.viewer` on the subscription from Step 4.2, then generate and download a JSON key file for it.
   * **Workload Identity Federation**: avoids a long-lived key file, at the cost of more setup — see [Panther's GCS source documentation](https://docs.panther.com/data-onboarding/data-transports/google/cloud-storage) for the full attribute-mapping and trust configuration.
5. Back in Panther, upload the JSON key file (or credential configuration file, if using Workload Identity Federation) and provide the **GCS Bucket Name** and **Pub/Sub Subscription ID** from Step 4.2.
6. Click **Setup**, then attach a schema to the source.

This service account is what lets **Panther read** from the bucket — it's a completely separate identity from the one Realm uses to **write** to it, created next.

### 4.4 Create a Service Account for Realm to Write With

> **Note:** Realm does not support the legacy P12 secret — ensure you create a JSON GCP Service Account Key.

1. Go to **IAM > Service Accounts**.
2. Click **Create Service Account**.
3. Enter a name for the service account:
   > **Name:** `realm-archive-account`
4. Click **Create and Continue**.
5. Grant permission to write to the bucket:
   * **Add role > Cloud Storage > Storage Object Creator**
6. Add an IAM condition to restrict access to just this one bucket:

```text
resource.service == "storage.googleapis.com" &&
resource.name.startsWith("projects/_/buckets/REPLACE_WITH_BUCKET_NAME")
```

7. Select the service account.
8. Go to **Keys > Create Key > JSON**.
9. Click **Create**. The service account key downloads to your local machine. Open it in a text editor, select all contents, and copy to clipboard — you'll paste this directly into Realm in the next step.

### 4.5 Configure the GCS Destination in Realm

1. Navigate to **Destinations > Add Destination**.
   > **Name:** `Archive`\
   > **Type:** `Data Lake`
2. Under **Destinations**, select **Add New Source** and connect the relevant log source(s) you want delivered to Panther.
3. Go to **Output Feeds > Add Output Feed**, choose the **GCS** output feed type, and configure:
   > **Name:** `GCS Archive`\
   > **Bucket Name:** The bucket from Step 4.1\
   > **Service Account Key:** Paste the JSON key copied in Step 4.4

> **Note:** As with S3, the credentials Realm uses to write (Step 4.4) and the credentials you gave Panther to read (Step 4.3) are two different service accounts scoped to two different, non-overlapping permission sets, even though both point at the same bucket.

## Export Detections for Detection Integrity

[Detection Integrity](/product/detection_integrity) checks your log optimization rules against your Panther detections, so optimizations never drop data a detection depends on. Export your detections as described below, then upload them to Realm.

Panther detections are Python and YAML files.

1. In the Panther Console, click **Detections** in the left-hand navigation.
2. Click **Upload**.
3. In the Bulk Uploader, click **Download all entities**. Panther downloads a `.zip` archive of your detections (`.py` and `.yml` files), helpers, data models, and saved and scheduled searches.

![Panther Detections page with the Upload button](../images/panther-detection-export-1.png)

![Panther Bulk Uploader with Download all entities](../images/panther-detection-export-2.png)

### Upload the Export to Realm

Upload the exported archive as described in [Upload Detections to Realm](/product/detection_integrity#upload-detections), selecting your Panther destination.

## Related Resources

* [Setup GCS Service Account Key](https://cloud.google.com/iam/docs/service-account-overview)
* [Setup GCS Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)