When a log source is deleted, does Panther capture the source ID in it's audit logs?
QUESTION
When a log source is deleted, there's an event in Panther's audit logs for DELETE_LOG_SOURCE. Does the event contain any information about the deleted source?
ANSWER
Currently, any identifying information about the deleted source is not included in the audit log event, but we are investigating adding this information. If this is a blocker or a serious issue for you, or if you are interested in support of this feature (including deleted source information in the audit log event), please bring it up with your Account Executive (AE) or our Support team!