Can Panther log user activity?

QUESTION

Does Panther use any kind of internal auditing to record user activity? How can I access this data?

ANSWER

Yes, Panther records user activity via the Panther Audit log source. These logs can be accessed the same as any externals logs Panther ingests, and you can create detections against them as well. You can read more about Panther Audit Logs in our documentation.

If you don't see Panther Audit as an available Log Source, you may need to have it enabled for your instance. Note that even if Panther Audit is not available to you, user activity is still recorded, and you can access historical user data once Panther Audit has been enabled.