---
title: "Panther"
description: "Reference for the Tracecat Panther integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Bulk update Panther alerts

Action ID: `tools.panther.bulk_update_alerts`

Update multiple Panther alerts at once.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="alert_ids" type="array[string]" required>

List of alert IDs to update.

</ParamField>

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="assignee" type="string | null">

User ID to assign the alerts to.

Default: `null`.

</ParamField>

<ParamField path="status" type="string | null">

New status for the alerts.

Default: `null`.

</ParamField>

## Create Panther query

Action ID: `tools.panther.create_query`

Create a new saved query in Panther.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="name" type="string" required>

Name of the saved query.

</ParamField>

<ParamField path="sql" type="string" required>

SQL query to save. Must be valid SQL, not PantherFlow.

</ParamField>

<ParamField path="description" type="string | null">

Description of the query.

Default: `null`.

</ParamField>

<ParamField path="schedule" type="object | null">

Schedule configuration for the query.

Default: `null`.

</ParamField>

## Delete Panther query

Action ID: `tools.panther.delete_query`

Delete a saved query from Panther.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="query_id" type="string" required>

The unique identifier of the saved query.

</ParamField>

## Execute Panther query

Action ID: `tools.panther.execute_query`

Execute a saved query in Panther.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="query_id" type="string" required>

The unique identifier of the saved query.

</ParamField>

<ParamField path="parameters" type="object | null">

Parameters to pass to the query.

Default: `null`.

</ParamField>

## Get Panther alert

Action ID: `tools.panther.get_alert`

Get a single alert from Panther by ID.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="alert_id" type="string" required>

The unique identifier of the alert.

</ParamField>

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

## Get Panther query

Action ID: `tools.panther.get_query`

Get a saved query from Panther by ID.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="query_id" type="string" required>

The unique identifier of the saved query.

</ParamField>

## List Panther alerts

Action ID: `tools.panther.list_alerts`

List alerts from Panther with optional filters.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="cursor" type="string | null">

Pagination cursor for next page.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer | null">

Maximum number of alerts to return.

Default: `null`.

</ParamField>

<ParamField path="severity" type="string | null">

Filter by alert severity.

Default: `null`.

</ParamField>

<ParamField path="status" type="string | null">

Filter by alert status.

Default: `null`.

</ParamField>

## List Panther queries

Action ID: `tools.panther.list_queries`

List saved queries from Panther.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="cursor" type="string | null">

Pagination cursor for next page.

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer | null">

Maximum number of queries to return.

Default: `null`.

</ParamField>

## Update Panther alert

Action ID: `tools.panther.update_alert`

Update a Panther alert's status or assignee.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="alert_id" type="string" required>

The unique identifier of the alert.

</ParamField>

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="assignee" type="string | null">

User ID to assign the alert to.

Default: `null`.

</ParamField>

<ParamField path="status" type="string | null">

New status for the alert.

Default: `null`.

</ParamField>

## Update Panther query

Action ID: `tools.panther.update_query`

Update a saved query in Panther.

### Secrets

Required secrets:

- `panther`: required values `PANTHER_API_KEY`.

### Input fields

<ParamField path="base_url" type="string" required>

Panther API URL (e.g. https://api.runpanther.net).

</ParamField>

<ParamField path="query_id" type="string" required>

The unique identifier of the saved query.

</ParamField>

<ParamField path="description" type="string | null">

New description for the query.

Default: `null`.

</ParamField>

<ParamField path="name" type="string | null">

New name for the query.

Default: `null`.

</ParamField>

<ParamField path="schedule" type="object | null">

New schedule configuration for the query.

Default: `null`.

</ParamField>

<ParamField path="sql" type="string | null">

New SQL query. Must be valid SQL.

Default: `null`.

</ParamField>
