Reported operating use · Security monitoring
AI security alert investigation: Panther example
Panther embeds agent analysis, using Anthropic Claude through Amazon Bedrock, into detection and response work, with customer account integrations giving access to security data. Present actions are query and triage; broader multi-agent and rule-writing capabilities are future direction. Rollout cohort and independent accuracy are not disclosed.
Alert triage, query-based investigation and contextual security records
Panther
Launched customer-facing security-agent capabilities; exact rollout cohort undisclosed.
A published third-party example, not a Nuvepro customer case or evidence of a partnership.
The workflow at a glance
Panther reported work
Illustrative summary of the published account
Reported work components. Their arrangement does not imply a fixed execution order or simultaneous work.
- Security context
Customer account integrations
Provide access to tenant-specific security data.
- Current work
Query and triage analysis
Agent analysis supports detection and investigation.
- Scope distinction
Broader capabilities remain prospective
Multi-agent and rule-writing plans are not all present actions.
What the source reports
Panther embeds agent analysis into detection and response work and uses customer account integrations for access to security data. The source describes present query and triage actions while discussing some broader multi-agent and rule-writing capabilities as future direction. Customer-specific context is central to the implementation.
Reported technology: Anthropic Claude through Amazon Bedrock. Scope and outcomes are source-reported.
What the enterprise environment would need
The following is a proposed project design for an enterprise doing similar work. Published details are marked; the remaining systems, data and scenarios would be agreed for your project.
Proposed practice environment
Triage security alerts with supported queries
Illustrative project design to scope with your enterprise.
- 1 · Set up the environment
Tenant alert bundle
Fictional identities, assets, data-lake events and query permissions remain linked.
- 2 · Preparation and agent contributions
Draft investigation queries
Produce supported risk findings or comments with unresolved context exposed.
- 3 · Independent checks
Check queries and access
Independent reviewers inspect actual results, missed threats and unauthorized record changes.
- 4 · People decide acceptance
Security analyst accepts findings
Review escalation and uncertainty without treating a comment as containment authority.
A reviewable evidence package
A query-evidence packet and proposed investigation comments.
If a check fails → withhold acceptance.
A denied decisive source is replaced with fabricated context. Withhold acceptance, repair, independently recheck and return to owner review.
Failure or owner rejection returns to review
- Hold
- → 2 · Revise work
- → 3 · Rerun independent checks
- → 4 · Owner review
Operating boundary. Licensed test tenant only; no live rule deployment or containment.
- Systems and tools
- Published: Panther, AWS integrations and a security data lake. Proposed: licensed test tenant and seeded telemetry.
- Data and state
- Proposed: preserve identity, asset and alert relationships; customer security data requires explicit rights.
- People and handoffs
- Proposed: analyst inspects risk judgment and decides remediation; distinguish comments from authorized response.
- Rules and authority
- Proposed: retain tenant permissions, query limits and escalation policy in the test setting.
- Normal and exception cases
- Proposed: noisy alert, high-risk chain and incomplete evidence with matched analyst labels.
- Reset and replay
- Proposed: restore alerts, comments and telemetry snapshots. Not evidenced as a published feature.
A proposed simulation
An illustrative practice design derived from this work, not an executed assessment.
Triage alerts across customer identity and asset context, write supported investigation queries or comments, and escalate unresolved risk.
Review gate: Check evidence coverage, permitted data access and correct escalation; do not assume containment authority.
Challenge the result: Deny a decisive data source. The assessment must distinguish justified uncertainty from an investigation that silently fabricates missing context.
What needs checking
- Published: vendor model selection and qualitative reasoning evaluation.
- Proposed: check query results, risk calibration, missed threats and unauthorized record changes.
- Proposed: compare test data lake, permissions and analyst procedure with the customer's actual instance.
Review environment fidelity, human capability and agent performance separately. The enterprise’s accountable owners decide acceptance of the shared workflow and any operating use.
How an enterprise could build similar work
A proposed build order for an enterprise doing similar work, written by Nuvepro from the published account and our interpretation of the environment and checks above. It is not how Panther built or operates this work.
- Frame a proposed triage projectThis is a proposed design for a similar project, not a description of Panther's implementation. The mission: triage alerts across customer identity and asset context, write supported investigation queries or comments, and escalate unresolved risk.
- Stand up a licensed test tenantUse a licensed test tenant with seeded telemetry. Preserve identity, asset and alert relationships; customer security data requires explicit rights before it enters any test setting. Compare the test data lake with the customer's actual instance.
- Keep permissions and escalationRetain tenant permissions, query limits and escalation policy in the test setting. An analyst inspects the risk judgment and decides remediation, and the test distinguishes comments from authorized response without assuming containment authority.
- Seed cases with analyst labelsInclude a noisy alert, a high-risk chain and a case with incomplete evidence, each with matched analyst labels. Restore alerts, comments and telemetry snapshots between runs so that results stay comparable.
- Deny a decisive data sourceDeny a decisive data source. The assessment must distinguish justified uncertainty from an investigation that silently fabricates missing context. Check query results, risk calibration, missed threats and unauthorized record changes.
- Check coverage before acceptanceCheck evidence coverage, permitted data access and correct escalation. Accept the result as readiness evidence only after the test permissions, data lake and analyst procedure have been compared with the real instance.
Your systems, data, rules and accountable owners decide the real project. Agree acceptance criteria, escalation owners and operating responsibility with the people accountable for the work before anything runs on live records. Treat the first run as a rehearsal on test records: compare the draft output with an independently prepared answer, and record what the people reviewing it change.
Questions about this example
- What does Panther use AI for in security monitoring?
- Panther embeds agent analysis into detection and response work for alert triage, query-based investigation and contextual security records, using customer account integrations to reach security data. Some multi-agent and rule-writing capabilities are described as future direction, not present features.
- Who stays in charge of Panther's AI triage?
- The source does not fully disclose the permissions of each launched action. As proposed checks, not reported practice, an analyst inspects the risk judgment and decides remediation, comments are distinguished from authorized response, and tests look for unauthorized record changes.
- How strong is the evidence for this example?
- It is reported use: customer-facing capabilities have launched, but the rollout cohort is undisclosed. Deployment breadth, independent triage accuracy and the exact permissions of each launched action are not fully disclosed. The published evaluation is vendor model selection and qualitative reasoning, not an independent benchmark.
- What would an enterprise need to build something similar?
- This is Nuvepro's proposed design, not Panther's setup. It would use a licensed test tenant with seeded telemetry, preserved identity, asset and alert relationships, tenant permissions, query limits and escalation policy, and noisy, high-risk and incomplete-evidence cases with analyst labels. Customer security data needs explicit rights.
Shape this around your enterprise
Bring a similar workflow and the people responsible for it. Together, define the records and systems to use, the result your team will build or configure, and how its owners will check it. Nuvepro scopes the simulation, environment and preparation. Agree any existing-agent evaluation, implementation assistance and production responsibilities separately.
Sources and limitations
Curation review: . This is the date this source example was reviewed, separate from source publication dates.
- Deployment breadth, independent triage accuracy and the exact permissions of each launched action are not fully disclosed.