QUESTION

How can I programmatically retrieve the SQL code from my past queries in Panther?

ANSWER

You can use Panther's REST API to retrieve queries that have run in your Panther instance, including their SQL code.

To retrieve your queries:

1. Create an API token and Ensure it has the necessary permissions for querying data.

2. Navigate to the API Playground in your Panther Console.

3. Select the REST API endpoint and insert your API token in the authorization panel.

4. Navigate to the list queries operation.

5. Use the "cursor" parameter for pagination if needed.

6. Adjust the "limit" parameter to control the maximum number of results to return. By default, each request returns the last 100 runs, sorted by time.

7. Execute the API call.

After running the API call, you can use the automated "copy" or "download" button to export the data for further analysis.