Run any Skill in Manus with one click

panther

Queries Panther SIEM data lake via GraphQL API. Use when the user wants to query Panther logs, run SQL against the data lake, search for indicators of compromise, explore databases/tables/columns, poll for query results, list past queries, build GraphQL scripts, or manage Panther alerts. Triggers on: "query Panther", "Panther data lake", "Panther GraphQL", "search Panther logs", "indicator search in Panther", "executeDataLakeQuery", "executeIndicatorSearchQuery", "panther_logs", "Panther alerts", "list alerts", "alert status", "triage alert", "resolve alert", "assign alert", "mark alert as resolved", "update alert", "comment on alert", or any request to pull log data, hunt threats, or manage security alerts via the Panther API. Also triggers on "search my logs", "find this IP in Panther", "show me my alerts", or "close these alerts".

Run Skill in Manus

Stars15

Forks1

UpdatedMay 13, 2026 at 16:51

Source

pbnj

pbnj/.dotfiles

View GitHub Repository View Creator Repositories

Install command

Download

Run Skill in Manus

Useful forSOC

Information Security AnalystsComputer and Mathematical Occupations15-1212L4

File Explorer

6 files

SKILL.md

readonly

More from this repository

same repository

linear-cli

pbnj/.dotfiles

Use when interacting with Linear.app from the command line. Triggers on any request involving Linear issues, projects, cycles, sprints, teams, roadmaps, milestones, documents, triage, notifications, comments, bulk operations, or any Linear workflow. Also triggers when the user references a Linear issue identifier (e.g. ENG-123, LIN-456), wants to list/create/update/close/assign issues, check sprint status, run burndown charts, import/export Linear data, manage webhooks, or automate Linear tasks from the terminal. Use proactively whenever the user mentions "Linear", "linear issue", "linear sprint", "linear project", "linear ticket", or any Linear-related workflow — even if they don't explicitly ask for the CLI.

2026-05-1715

address-pr-comments

pbnj/.dotfiles

Use when addressing, responding to, or resolving pull request review comments and inline code suggestions. Triggers whenever the user wants to work through PR feedback — even if they say 'address the review comments', 'fix the PR feedback', 'apply the suggestions', 'resolve the threads', 'respond to reviewer comments', or just 'let's work through this PR review'. Use proactively after a PR review is received.

2026-05-1315

nuclei

pbnj/.dotfiles

Security testing skill for Nuclei — a fast, template-driven vulnerability scanner by ProjectDiscovery. Use this skill to: scan URLs, APIs, or OpenAPI specs for vulnerabilities; run or write nuclei YAML templates and workflows; generate templates from a STRIDE threat model report; or run a full pipeline (threat model → templates → scan). Triggers on: "run nuclei", "scan this URL", "nuclei template", "nuclei workflow", "nuclei from threat model", "web app security scan", "pen test this API", "full security pipeline", "threat model and scan", SQLi, XSS, SSRF, IDOR, auth bypass, CORS misconfig. Use proactively when the user shares a URL, OpenAPI spec, source code, or STRIDE report and wants security testing — even if they haven't mentioned nuclei by name.

2026-05-1315

snyk

pbnj/.dotfiles

Interact with the Snyk REST API (v2025-11-05) for vulnerability management, security scanning, and developer security. Use for: listing orgs/projects/targets, querying issues (package vulnerabilities, licenses, cloud misconfigs, SAST), searching audit logs, managing service accounts, memberships, invitations, fetching SBOMs, and looking up package vulnerabilities by PURL. Requires SNYK_TOKEN injected via 1Password `op run`.

2026-05-1315

aws-cli

pbnj/.dotfiles

Use when interacting with AWS. Triggers on AWS resources, services, or accounts — s3, ec2, iam, kms, secretsmanager, eks, ecs, lambda, cloudwatch, rds, dynamodb, cloudformation, route53, sns, sqs, and more. Use this skill whenever the user wants to inspect, query, troubleshoot, or manage AWS infrastructure, even if they don't say 'AWS' explicitly but reference cloud resources, ARNs, account IDs, regions, or specific AWS service names.

2026-05-1315

gh-cli

pbnj/.dotfiles

Use when interacting with GitHub from the command line. Triggers on any request involving pull requests, issues, repositories, GitHub Actions workflows, releases, GitHub API calls, or the `gh` command — even if the user doesn't say 'gh' but mentions checking out a PR, creating an issue, viewing workflow runs, listing releases, or querying the GitHub API. Use proactively for any GitHub operation that can be done from the terminal.

2026-05-1315

name

panther

description

Panther Data Lake GraphQL Queries

Security Rules

Never access 1Password secrets beyond what is documented in this skill (i.e. op://Employee/panther/instance_url and op://Employee/panther/api_token). Do not browse vaults, list items, or read any other secrets unless the user explicitly authorizes it.

How to run queries

This skill includes two ready-to-run Python scripts. Always use these scripts to execute queries rather than writing GraphQL by hand — they handle auth, async polling, and pagination automatically.

The scripts live next to this file in scripts/. Resolve their absolute path relative to this skill file's location before running.

Prerequisites

Dependencies are managed with uv — no separate install step needed. uv run reads the inline script metadata and installs gql and aiohttp into an isolated environment on first run automatically.

Credentials are stored in 1Password and injected at runtime via op run. The expected secret references are:

PANTHER_INSTANCE_URL = op://Private/panther/instance_url
PANTHER_API_TOKEN = op://Private/panther/api_token

If the item name or vault differs in the user's 1Password, ask them to confirm the correct op://vault/item/field references before running.

Run a SQL query

op run -- uv run /path/to/skill/scripts/query_data_lake.py "<SQL>"

Example:

op run -- uv run scripts/query_data_lake.py "select * from panther_logs.public.aws_cloudtrail limit 20"

Results are returned as a JSON array on stdout.
Progress and status messages are on stderr (won't pollute captured output).
The script polls until the query completes and pages through all results automatically.

Run an indicator search

op run -- uv run scripts/indicator_search.py \
        --indicators "<value1>" "<value2>" \
        --start-time "<ISO8601>" \
        --end-time "<ISO8601>" \
        [--indicator-name field <p_any_* >]

Example:

op run -- uv run scripts/indicator_search.py \
        --indicators "1.2.3.4" \
        --start-time "2024-06-01T00:00:00.000Z" \
        --end-time "2024-06-30T23:59:59.000Z" \
        --indicator-name p_any_ip_addresses

Omit --indicator-name to let Panther auto-detect the indicator type.
Common --indicator-name values: p_any_ip_addresses, p_any_aws_account_ids, p_any_domain_names, p_any_sha256_hashes, p_any_md5_hashes.

Working with Alerts

Two scripts handle all alert operations. Run them with op run -- uv run just like the query scripts.

Get a single alert

op run -- uv run scripts/get_alert.py <alert-id>

Example:

op run -- uv run scripts/get_alert.py 6087bc1d6fc49ce97ef3c85ca0e3f31b

Outputs a JSON object with full alert details: id, title, description, severity, status, type, riskScore (classification, indicators), createdAt, updatedAt, firstEventOccurredAt, lastReceivedEventAt, reference, runbook, assignee, origin (detection or system error), and deliveries (Jira/Slack dispatch records).

List alerts

op run -- uv run scripts/list_alerts.py \
        --start-time "<ISO8601>" \
        --end-time "<ISO8601>" \
        [--severities INFO LOW MEDIUM HIGH CRITICAL] \
        [--statuses OPEN TRIAGED RESOLVED CLOSED]

Example — all open HIGH/CRITICAL alerts in June 2024:

op run -- uv run scripts/list_alerts.py \
        --start-time "2024-06-01T00:00:00.000Z" \
        --end-time "2024-06-30T23:59:59.000Z" \
        --severities HIGH CRITICAL \
        --statuses OPEN

Outputs a JSON array. Each alert includes: id, title, severity, status, createdAt, updatedAt, assignee, and origin (detection name or system error type).

Update alert status

op run -- uv run scripts/update_alerts.py status \
        --ids "<alert-id-1>" "<alert-id-2>" \
        --status RESOLVED

Valid statuses: OPEN TRIAGED RESOLVED CLOSED

Add a comment

op run -- uv run scripts/update_alerts.py comment \
        --id "<alert-id>" \
        --body "Investigation complete. False positive."

Add --html to send the body as HTML instead of plain text.

Assign alerts to a user

# by email
op run -- uv run scripts/update_alerts.py assign \
        --ids "<alert-id-1>" "<alert-id-2>" \
        --email analyst@example.com

# by Panther user ID
op run -- uv run scripts/update_alerts.py assign \
        --ids "<alert-id-1>" \
        --user-id "<panther-user-id>"

Unassign alerts

op run -- uv run scripts/update_alerts.py unassign \
        --ids "<alert-id-1>" "<alert-id-2>"

Key Patterns to Remember

Always poll: executeDataLakeQuery and executeIndicatorSearchQuery return an id immediately — the query runs async. Poll dataLakeQuery(id: ...) in a loop until status !== "running".
SQL only: API queries must be SQL. PantherFlow syntax is not accepted.
Table naming: Standard format is panther_logs.public.<log_type>, e.g. panther_logs.public.aws_cloudtrail.
Indicator fields: Common indicatorName values include p_any_ip_addresses, p_any_aws_account_ids, p_any_domain_names, p_any_sha256_hashes. Leave blank for auto-detection.
Alert filters require a time range: alerts() always needs createdAtAfter and createdAtBefore — the query will fail without them.
Alert status is an enum: Pass values unquoted in raw GraphQL (RESOLVED), but as plain strings in the scripts (--status RESOLVED).
Credentials: All scripts need PANTHER_INSTANCE_URL and PANTHER_API_TOKEN. Always inject via op run -- so secrets never touch the shell history.