Panther is a security operations platform for teams that want to run detection and response on their own security data lake. Security teams drown in alerts, and investigations stall when the evidence sits in separate tools; Panther brings that evidence together and uses AI agents to work through the alerts.
Panther is now part of Databricks.
At A Glance
| Vendor | Panther, part of Databricks |
|---|---|
| Category | AI SOC platform, detection and response |
| Identities covered | Identity provider and cloud IAM logs |
| Deployment | Hosted managed cloud, or connected to the customer’s own cloud or data lake |
| Agentic AI | AI SOC Agent, AI Detection Builder, MCP server |
| Customers | Zapier, Cockroach Labs |
| Certifications | SOC 2 Type II, PCI DSS, ISO 27001 |
| Market classification | Security Operations |
What Panther Does
Panther puts security logs from cloud, identity, endpoint and SaaS sources into one structured data lake, normalises them and runs detections against them in real time, so analysts search and investigate in one place. When an alert is investigated, the outcome is stored and reused, so the same question does not have to be answered twice and each investigation makes the next detection sharper. Because detections are code, detection engineers can treat them like software, reviewing and testing them before they go live.
Products
Data Pipeline
The data pipeline brings in logs from cloud, network, host and application sources, then parses and normalises them so every source can be queried the same way. Logs from systems inside the customer’s network can be sent through the on-premises Panther Log Forwarder.
Detection Engine
Detection engineers write rules in Python and manage them with version control and CI/CD, an approach known as detection-as-code. Teams without that skill set can describe a detection in natural language and have the AI Detection Builder write it, or use the Simple Detection Builder.
Alerting And Triage Automation
Every alert is triaged with its full context. Confirmed benign alerts close on their own and repeat alerts are suppressed. Alerts that need a person are routed to destinations such as Slack, PagerDuty and Jira.
AI SOC Agent
The AI SOC Agent works through alerts and telemetry on a schedule, hunts across the full data lake at a regular cadence and answers questions asked in natural language. During an investigation it pulls live context from tools such as GitHub, PagerDuty, Atlassian, Notion and Slack, and it can take action with that context.
Analytics And Reporting
Analysts search and investigate across the whole data lake, with data enrichment and reporting for compliance. Developers can automate the platform through the Panther API and the Panther Analysis Tool.
How It Works
Customers choose one of two deployment models: hosted, where Panther runs a managed cloud for the customer, or connected, where the customer brings its own cloud or data lake.
The rest of the architecture is the same in both.
| Component | What it does |
|---|---|
| Data lake | For long-term retention, data is kept in Snowflake or Databricks and stays queryable. |
| AI processing | AI runs in an isolated tenant on Amazon Bedrock, with no data shared across tenants and no customer data used to train models. |
| Lakewatch | Databricks Lakewatch is the Databricks agentic SIEM on its security lakehouse. It keeps telemetry in open formats such as OCSF, Delta and Parquet and governs it through Unity Catalog. |
Identities And Systems Covered
Panther detects threats in logs from these identity and cloud systems:
| Identity providers | Okta, OneLogin, Microsoft Entra ID, Auth0 and Duo Security |
|---|---|
| Cloud IAM and keys | AWS IAM, password policy, KMS keys and ACM certificates |
| Secrets and access tools | 1Password, Bitwarden and Teleport |
| Cloud platforms | AWS services such as CloudTrail, GuardDuty and EKS, plus Azure and GCP |
| AI services | Amazon Bedrock model invocation, Anthropic compliance and OpenAI logs |
Agentic AI Capabilities
MCP Server
Panther runs its own MCP server, so external tools and agents can query alerts, detections and log data directly. The Slack, PagerDuty, Notion, GitHub and Atlassian MCP servers connect the other way, feeding context into Panther’s agents.
Agent Controls
Agents act under the identity of the person who invoked them and never with more rights. Every write needs human approval, and every AI action is logged and can be reviewed, so a team can see what an agent looked at, what it changed and who signed off.
Integrations
| Area | Integrations |
|---|---|
| Cloud log sources | Amazon Security Lake and OCSF, Wiz, Orca Security |
| Network | Cloudflare, Zscaler, Tailscale, Zeek, Suricata, Cisco Umbrella |
| Host and endpoint | CrowdStrike, SentinelOne, Carbon Black, Sophos, Windows Event Log, Osquery |
| SaaS applications | Microsoft 365, Google Workspace, Salesforce, GitLab, Snowflake Audit |
| Alert destinations | Microsoft Teams, Tines, Torq, Splunk, Custom Webhooks |
| Enrichment | Google Threat Intelligence, Anomali ThreatStream API, IPInfo, Open Threat Exchange |
Company Background
| Headquarters | San Francisco, United States |
|---|---|
| Leadership | Jack Naglieri (Founder and CEO), John McCarthy (Chief Revenue Officer) |
| Funding | $120 million Series B led by Coatue, at a reported valuation of $1.4 billion |
| Ownership | Acquired by Databricks in 2026; Panther’s capabilities are moving into Databricks Lakewatch |
Note: This overview is compiled from Panther’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.