QUESTION

When uploading a detection via the Panther Analysis Tool (PAT), is it expected that the instance will display "Panther created"? Will the user only be shown when detections are created directly through the console?

ANSWER

Any item created using an API token, including Panther Analysis Tool (PAT), will be labeled as "created by Panther" unless the CreatedBy field exists and specifies a different user.