Skip to main content
Panther Knowledge Base

When a log source is deleted, does Panther capture the source ID in it's audit logs?


When a log source is deleted, there's an event in Panther's audit logs for DELETE_LOG_SOURCE. Does the event contain any information about the deleted source?


Currently, any identifying information about the deleted source is not included in the audit log event, but we are investigating adding this information. If this is a blocker or serious issue for you, please bring it up with your CSM, or our support team!