Why does clicking a Slack alert notification link show different information in Panther?

Last updated: June 24, 2025

QUESTION

Why is the event in the alert context of the Panther Slack notification different than the event shown in the Panther console, after clicking Click to view in Panther UI?

ANSWER

This difference in events shown is because when clicking an alert link from Slack, you'll be directed to a page that may contain multiple related alerts (shown as 1/8, 2/8, etc.).

When Panther processes the first event that triggers the rule (which might be event 2/8), that will be the event sent in the Slack notification. When Panther shows the batch of events in the console, they will be arranged in chronological order.

While the specific alert from your Slack notification will always be contained within the batch, you may need to scroll through the batch to locate it.