Panther
Connect Panther to Ploy to see every user in your Panther tenant, their role, whether they are deactivated, and when they last signed in. Ploy can also invite people into Panther, change their role, and remove them.
This integration is in beta
The Panther integration is in beta. It was built from Panther's API documentation and has not yet been checked against a live Panther tenant, so some details may need adjusting once customers connect it. Beta does not limit what the integration can do.
The first step of setup is a consent checkbox. Ticking it lets Ploy capture redacted error data when a request to Panther fails: the error response Panther sends back, with personal details, tokens and other secrets removed. Ploy uses it only to fix problems with this integration. You must tick the box to continue.
What Ploy reads
Every user in your Panther tenant, with their name and email address
Each user's role: Admin, Analyst, AnalystReadOnly, or one of your custom roles
Whether each user is deactivated, or invited and still to sign in for the first time
When each user last signed in
Ploy does not read your alerts, detections, log sources or data lake.
Before you start
You need to be able to create API tokens in Panther, which needs the Manage API Tokens permission (the Admin role has it).
Panther has no groups or teams. Each user's role is their access, and Ploy shows it as an entitlement on the Panther app.
Create an API token in Panther
Sign in to the Panther Console.
Open Settings, then Developer Tools, then API Tokens.
Copy the API URL shown on that page. You will paste it into Ploy. It looks like https://api.your-company.runpanther.net/public/graphql.
Create a new token and give it a name such as Ploy.
Give it the Read User Info permission. Add Manage Users too if you want Ploy to invite people, change roles and remove people. Manage Users lets the token change any role's permissions, so treat the token as an admin credential.
Leave the allowed IP list empty, or include Ploy's egress IP addresses.
Save the token and copy its value straight away. Panther shows it only once. A new token can take up to a minute to start working.
Connect Panther in Ploy
In Ploy, open Integrations and choose Panther.
Tick the beta consent checkbox.
Paste the API URL you copied from Panther.
Paste the API token.
Click Test. Ploy reads your Panther users to check the URL and token work.
Finish the setup. The first scan starts straight away.
Things to know
Users are checked every hour.
A deactivated user shows as inactive in Ploy and loses their access.
People who were invited but have not signed in yet still count as users with access.
Inviting a person gives them the AnalystReadOnly role unless you choose another, and Panther emails them a temporary password. Someone who already has a Panther user is left as they are. Ploy needs the person's first and last name to invite them.
Removing a role from a person moves them to AnalystReadOnly. It never removes them from Panther.
Removing a person deletes their Panther user. This cannot be undone from Ploy. Panther does not let anyone delete the last Admin.
Ploy cannot deactivate or reactivate Panther users, and does not create or edit roles.
Troubleshooting
Panther refused the API token
Check the token was copied in full, that it has not expired or been deleted, and that the API URL is the one shown on the same page in Panther. A new token can take up to a minute to start working.
The API URL was not accepted
Paste it exactly as Panther shows it under Settings, Developer Tools, API Tokens. It must start with https://.
Panther refused to list users
The token needs the Read User Info permission. If the token has an allowed IP list, it must include Ploy's egress IP addresses.
A change from Ploy was refused
The token needs Manage Users to invite people, change roles and remove people. Panther's own reason is shown with the error, for example when a change would remove the last Admin.