Skip to content
downpipes docs

Forward the downpipes audit trail to Panther

Panther receives the downpipes audit trail through an HTTP log source. The engine dials out to the source’s HTTPS URL on the scheduler tick and posts the audit events as a JSON array.

Panther needs one thing first: a schema (a log type) for the events. Until you infer or define one, Panther ingests the raw JSON but does not normalise it into typed fields. This is the difference from Splunk and Datadog, which parse a first-time feed with no schema step.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • A Panther role that can add an HTTP log source and define or infer a schema.
  • The HTTP source URL and its auth token, and owner access to the downpipes console.

Set it up

  1. In Panther, create an HTTP log source (under Configure, Log Sources, then the HTTP source type). Choose the auth method Panther offers (for example a Bearer token or a shared-secret header), and note the URL and token.
  2. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  3. Set the sink to HTTPS endpoint, the format to JSON array, and paste the Panther source URL. Panther also accepts the Splunk HEC format if you prefer a HEC-shaped source.
  4. Set the auth header to match the method you chose in Panther. For a Bearer token, leave the header name as Authorization and paste Bearer <token>.
  5. In Panther, infer a schema from the sample data or define one by hand, so the audit fields become typed columns.
  6. Choose Test send and confirm Panther accepts it, then Enable the destination.

What lands in Panther

Each batch arrives as a JSON array of raw audit events:

[{"seq":4097,"ts":"2026-06-19T02:14:08.221Z","actorEmail":"ops@acme.example","action":"restore-approve","outcome":"success","...":"..."}]

Panther applies the schema you defined, so action, outcome, actorEmail, seq and the rest become queryable columns. The ts field is the event time.

Good to know

  • Define the schema before you rely on searches. Panther normalises the audit events only once the log source has an inferred or hand-written schema; until then the JSON is stored but not typed.
  • Panther caps a POST at 1 MB, and delivery is at-least-once. The engine drains up to 500 small events per tick, under the cap, and a larger backlog drains over successive ticks; dedup on the stable seq or hash. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .