QUESTION

I am seeing the notification: "You have exceeded your inference quota of X per hour, please try again later" when using the Panther AI. How can I monitor my AI usage?

ANSWER

Panther AI has two separate hourly quotas (tracked independently) that apply specifically to AI-initiated activity, (not to manual SQL queries run in Data Explorer):

• ai_quota_inferences_per_hour: Each Panther AI conversation turn counts as one inference. This includes sending a message to Panther AI, following up in a conversation, or triaging an alert via Panther AI.

• ai_quota_datalake_queries_per_hour: Each query that Panther AI executes against the data lake counts toward this quota. The following four specific tool calls count toward this limit:

  • panther_ai_datalake_execute_sql

  • panther_ai_datalake_search_logs

  • panther_ai_datalake_activity_histogram

  • panther_ai_datalake_summarize_column

Other AI tool calls such as alertListTool, detectionTool, calculateRiskScoreTool, and logTypeSchemaTool do not count toward the data lake quota.

Monitoring usage via the AI Usage Dashboard

Panther also includes a built-in Usage page in the Panther console (Settings > Usage) that gives visibility into your team's Panther AI consumption.

It shows:

• Total AI runs against your current contract term

• Monthly usage trends across the contract term

• A daily breakdown by feature and by user over the last 30 days

See Panther's AI Usage Dashboard documentation for more details.

Note: The AI Usage Dashboard is powered by Panther audit logs. If audit logs are disabled on your instance, the Usage page will show no data.

Tracking usage via audit logs

For more granular programmatic tracking, you can also query Panther audit logs directly:

• To track AI inferences: filter for AI_INFERENCE_INVOKE events and group by hour.

• To track AI data lake queries: filter for AI_TOOL_INVOKE events where toolName is one of the four values listed above, and group by hour.

Can the limit be increased?

The hourly limits are a safeguard threshold. If the default limits are impacting your team's daily workflows, reach out to Panther Support to request an increase.