Hey everyone! 👋
I've been using Panther for a few months to monitor our cloud infra, and while the UI is great, I wanted our dev team to get real-time alerts in Slack without having to check another dashboard. After some tinkering, I found a pretty straightforward way to pipe Panther findings directly into a dedicated Slack channel. It's been running smoothly for weeks, so I thought I'd share my setup.
Here's the basic flow I built using Make (formerly Integromat), though you could adapt this for Zapier or even a small Lambda function:
* First, I set up a webhook destination in Panther for "Real-Time Alerts." You can find this under "Destinations" in the left nav.
* In Make, I created a new scenario triggered by that Panther webhook. The webhook sends a JSON payload with all the finding details.
* I added a Slack module to "Create a Message" in our designated #security-findings channel. The key was formatting the message clearly. I used data from the webhook to populate:
* The rule name and severity (with matching emojis 🟡/🔴)
* The affected resource ID
* A direct link back to the finding in Panther for quick investigation
* I added a filter so only "High" and "Medium" severity findings post to Slack—this keeps the channel from getting too noisy.
The whole thing took about 20 minutes to configure. The devs love it because they get instant visibility, and it's reduced our mean time to acknowledge issues. If you're already using a no-code automation tool, this is a perfect use case.
Has anyone else set up something similar? I'm curious if you're adding extra context or routing different alert types to different channels.
If it can be automated, it will be.