Hi team,

We want to let you know that Panther will stop writing to three databases at the end of 2025. The data written to each of these databases is already concurrently being written to a new location, and from the end of 2025 onward, you should only reference its new location (unless you are querying historical data from its original location).

No databases, tables, or data will be removed—the three databases that will stop receiving updates will still hold historical data and be available for querying indefinitely.

The databases that will stop being written to at the end of 2025 are:

• panther_rule_matches

  • Each match on a detection is now also written to panther_signals.correlation_signals (in Search, this is represented by the Signals database and Signals table).

• panther_rule_errors

  • Each detection error is now also written to panther_signals.correlation_errors (in Search, this is represented by the Signals database and Signals Errors table).

• panther_views

  • The panther_signals.correlation_signals table makes panther_views.all_rule_matches unnecessary.

  • The panther_signals.correlation_errors table makes panther_views.all_rule_errors unnecessary.

  • Panther’s Search and Data Explorer tools make it possible to search across multiple types of logs, Lookup Tables, cloud accounts, and monitoring sources, making panther_views.all_logs, panther_views.all_lookups, panther_views.all_cloudsecurity, and panther_views.all_monitoring unnecessary.

If you are currently using any of the views within panther_views, please reach out to Panther Support to let us know for what purpose—we would like to ensure you continue to have the capabilities you need when its updates cease.

Please let us know if you have any questions or concerns.