When a log source is deleted, does Panther capture the source ID in it's audit logs?
QUESTION
When a log source is deleted, there's an event in Panther's audit logs for DELETE_LOG_SOURCE. Does the event contain any information about the deleted source?
ANSWER
Currently, any identifying information about the deleted source is not included in the audit log event, but we are investigating adding this information. If this is a blocker or serious issue for you, please bring it up with your CSM, or our support team!