Install Jentic One Beta

Connect the Panther REST API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Panther REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fpanther.com%2Fmain" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fpanther.com%2Fmain" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Panther REST API.

Retrieve and update security alerts with status, assignee, and quality metadata

Create, rotate, and manage API tokens with permission scopes and IP allowlists

Create and manage Python-based detection rules with testing capabilities

Create, update, and delete saved and scheduled queries

Manage user accounts with role-based access control

GET STARTED

Start building with Panther REST API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Panther REST API for, with concrete tasks.

★ Alert Triage and Management

Retrieve and update security alerts during incident response workflows. GET /alerts/{id} fetches alert details including severity, status, and event count, while PATCH /alerts/{id} updates status, assignee, quality, or contextTags. Essential for security operations teams managing alert queues and incident escalation.

GET /alerts/{id} to retrieve alert, then PATCH /alerts/{id} to update status to RESOLVED and assign to analyst

Detection Rule Management

Create and update Python-based detection rules with built-in testing. POST /rules creates a new rule with optional run-tests-first and run-tests-only parameters, enabling test-driven detection development. PUT /rules/{id} updates existing rules with the same testing capabilities.

POST /rules with rule body and run-tests-first=true to validate before saving, or run-tests-only=true for testing without saving

API Token Lifecycle Management

Create, retrieve, rotate, and delete API tokens with granular permission scopes and IP allowlists. POST /api-tokens creates tokens with specified permissions array, POST /api-tokens/self/rotate rotates the current token, and DELETE /api-tokens/{id} revokes access. Critical for API security and credential rotation policies.

POST /api-tokens with name, permissions, and allowedCIDRBlocks, then POST /api-tokens/self/rotate for token rotation

Saved and Scheduled Queries

Create, update, and delete saved or scheduled queries for recurring searches across log data. POST /queries creates a saved query with optional schedule and emailConfig for automated report delivery. Essential for security analytics and compliance reporting workflows.

POST /queries with name, sql, schedule, and emailConfig to create scheduled query with email delivery

Agent-Driven SIEM Automation via Jentic

An AI agent managing security operations can triage alerts, create detection rules, and manage API tokens through Jentic without holding the X-API-Key in agent context. Jentic resolves intents like 'assign this alert' to the right Panther endpoint and supplies the request schema.

Search Jentic for 'update alert status', load the PATCH /alerts/{id} schema, and execute

Key Endpoints

16 endpoints — jentic publishes the only available openapi specification for panther rest api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/alerts/{id}

Get an alert by ID

PATCH

/alerts/{id}

Update alert status, assignee, quality, or contextTags

POST

/api-tokens

Create an API token

GET

/api-tokens/{id}

Get an API token by ID

DELETE

/api-tokens/{id}

Delete an API token

POST

/api-tokens/self/rotate

Rotate the current API token

POST

/rules

Create a Python detection rule

GET

/rules/{id}

Get a rule by ID

PUT

/rules/{id}

Update a rule

DELETE

/rules/{id}

Delete a rule

POST

/queries

Create a saved or scheduled query

GET

/queries/{id}

Get a query by ID

PUT

/queries/{id}

Update a query

DELETE

/queries/{id}

Delete a query

POST

/users

Create a user

GET

/users/{id}

Get a user by ID

GET

/alerts/{id}

Get an alert by ID

PATCH

/alerts/{id}

Update alert status, assignee, quality, or contextTags

POST

/api-tokens

Create an API token

GET

/api-tokens/{id}

Get an API token by ID

DELETE

/api-tokens/{id}

Delete an API token

POST

/api-tokens/self/rotate

Rotate the current API token

POST

/rules

Create a Python detection rule

GET

/rules/{id}

Get a rule by ID

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Panther API by hand means handling its X-API-Key auth, pointing at your own Panther deployment host, and building your own retry and error handling. Through Jentic you install once, import the Panther REST API from the API Directory, store the key once, and your agent calls it.

Permission scoping

Panther puts the alert and rule ids in the URL path (/alerts/{id} and /rules/{id}), so a rule can pin your agent to a specific alert or detection rule and the operations you approve. You choose the operations it may call, so rotating API tokens or deleting rules is not included unless you add them.

Credential isolation

Your Panther key is stored once, encrypted, by your own Jentic One instance and injected as the X-API-Key header at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'update an alert status' or 'create a detection rule', and Jentic returns the matching Panther operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using Panther REST API through Jentic.

Why is there no official OpenAPI spec for Panther REST API?

Panther does not publish a complete OpenAPI specification for their REST API. Jentic generates and maintains this spec so that AI agents and developers can call Panther REST API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Panther REST API use?

The Panther REST API uses an API key passed in the X-API-Key header. Through Jentic, the key is stored in the encrypted vault and injected at execution time so it never enters the agent's prompt context.

Can I test detection rules before saving them?

Yes. POST /rules accepts run-tests-first (default true) to run tests before saving, or run-tests-only=true to test without saving. This enables test-driven detection development and prevents broken rules from being deployed.

How do I rotate an API token?

POST /api-tokens/self/rotate rotates the current API token used for authentication. The endpoint returns a new token with the same permissions, and the old token is immediately invalidated.

Can I schedule queries to run automatically?

Yes. POST /queries accepts a schedule object to configure recurring execution, and an emailConfig object to deliver results via email. This enables automated security reporting and compliance workflows.

What alert statuses are supported?

Panther alerts support OPEN, CLOSED, TRIAGED, and RESOLVED statuses. PATCH /alerts/{id} updates the status, and you can optionally set assignee, quality (NOISE or USEFUL), and contextTags to enrich alert metadata.

Can I limit what my agent is allowed to do with the Panther API?

Yes. Because you run Jentic One yourself, your own rules decide which Panther operations and credentials the agent may use. Panther puts alert and rule ids in the URL path (/alerts/{id} and /rules/{id}), so a rule can pin the agent to a specific alert or detection rule and only the operations you approve, such as reading an alert with GET /alerts/{id} or updating its status with PATCH /alerts/{id}. Sensitive operations like rotating a token via POST /api-tokens/self/rotate or deleting a rule with DELETE /rules/{id} stay off limits unless you explicitly allow them.

Panther REST API

AI ReadinessAI-Aware (B-)62/100

See full scorecard

Agent-ready OpenAPI document · curated by JenticSecurityThreat DetectionapiKey16 EndpointsREST

Know of an official OpenAPI document? Contribute it →

For Agents

Manage SIEM alerts, rules, queries, users, and API tokens across 16 endpoints.

Use for: I need to get the details of a security alert, Update the status of an alert to resolved, Create a new Python detection rule, Run tests on a detection rule before saving

Not supported: Does not handle log ingestion, detection pack deployment, or dashboard creation - use for alert triage, rule management, and query automation only.

Jentic publishes the only available OpenAPI specification for Panther REST API, keeping it validated and agent-ready. The Panther REST API provides comprehensive interaction with Panther SIEM entities including alerts, API tokens, rules, users, and queries. It powers security operations workflows, threat detection rule management, and SIEM automation for cloud-native security teams using Panther's detection-as-code platform.

Jentic One on Github View OpenAPI Document

Show dimension breakdown

Foundational Compliance

Base layer of spec validity and structural soundness.

Grade: A-Signals: 4

98%

Lint Results

Aggregated quality score from linter diagnostics, weighted by severity.

100%

Resolution Completeness

Percentage of `$ref` references that resolve successfully.

100%

Specification Validity

Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).

10%

Structural Integrity

Structural correctness score based on schema issues using logarithmic dampening.

Developer Experience & Jentic Compatibility

Clarity, completeness, and ingestion readiness for developers and tooling.

Grade: B-Signals: 4

Example Density

How richly the API is illustrated with examples.

100%

Example Validity

Percentage of examples that conform to their schemas.

50%

Response Coverage

Percentage of operations with complete response definitions (success, client error, server error).

100%

Tooling Readiness

Health of API ingestion, bundling, and resolution within Jentic pipelines.

AI-Readiness & Agent Experience

Semantic breadth, depth, and agent comprehension for AI systems.

Grade: D+Signals: 4

29%

Description Coverage

Coverage of descriptions across API elements.

Error Standardization

Coverage of RFC 9457 Problem Details for error responses.

100%

OperationId Quality

Coverage, uniqueness, and casing consistency of operationIds for AI inference.

63%

Summary Coverage

Coverage of summaries across operations/tags/info.

Agent Usability

Functional utility, complexity comfort, and AI orchestration readiness.

Grade: A+Signals: 1

94%

Complexity Comfort

Agent comfort level based on API operational and structural complexity.

Security

Trust, risk posture, and security compliance.

Grade: C-Signals: 1

50%

Authentication Strength

Average quality of security schemes based on authentication method strength (weakest link for OAuth2).

AI Discoverability

Findability, semantic richness, and reasoning readiness.

Grade: B-Signals: 1

62%

Descriptive Richness

Clarity and depth of descriptions across API elements.

Connect the Panther REST API to your agent

Capabilities

Start building with Panther REST API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

Panther REST API

Jentic AI Readiness Score

Panther REST API

Foundational Compliance

Lint Results

Resolution Completeness

Specification Validity

Structural Integrity

Developer Experience & Jentic Compatibility

Example Density

Example Validity

Response Coverage

Tooling Readiness

AI-Readiness & Agent Experience

Description Coverage

Error Standardization

OperationId Quality

Summary Coverage

Agent Usability

Complexity Comfort

Security

Authentication Strength

AI Discoverability

Descriptive Richness