Skip to main content
Panther Knowledge Base

How can I see who edited/deleted a log source in Panther?


Is there a way for me to determine who altered or deleted a Panther log source?


Yes, provided you have enabled Panther's audit logging capabilities. Then, every user action in Panther is monitored, recorded, and queryable, just like any other log source in Panther.

To determine who altered or deleted a log source, you can use the following example query in the Data Explorer:

SELECT p_event_time AS p_timeline, actor:attributes:email AS employee, actionName as action, *
FROM panther_logs.public.panther_audit
WHERE actionName IN (
AND actionParams:dynamic:input:label = 'MY_LOG_SOURCE_NAME'
AND p_occurs_since(365d)
LIMIT 1000

Be sure to adjust MY_LOG_SOURCE_NAME to the title of the log source you're investigating!

  • Was this article helpful?