Can Panther log user activity?

QUESTION

Does Panther use any kind of internal auditing to record user activity? How can I access this data?

ANSWER

Yes, Panther records user activity via the Panther Audit log source. These logs can be accessed the same as any externals logs Panther ingests, and you can create detections against them as well. You can read more about Panther Audit Logs in our documentation.

If you don't see Panther Audit as an available Log Source, you may need to have it enabled for your instance. You will start getting the audit data from the moment that the audit logs were enabled for your account.