SIEM Export (Panther)

Ultra can deliver your organization’s alerts to an S3 bucket in your AWS account. Your SIEM reads them from there. This guide connects that bucket to Panther, but any tool that reads newline-delimited JSON from S3 can use the same export.

What You Get

Every alert Ultra raises, delivered as gzip-compressed NDJSON files (one alert per line)
Alerts raised from the moment you enable delivery. Earlier alerts are not backfilled.

Ultra can only write to your bucket. It cannot read, list, or delete anything in it.

Prerequisites

Owner or admin role in Ultra Hub
An AWS account where you can create an S3 bucket and an IAM role
A Panther account with permission to add log sources and schemas

Connect Amazon S3

First, connect Ultra Hub to your S3 bucket. In Ultra Hub, go to Settings > Integrations. Under Available integrations, click Add next to Panther. Ultra walks you through the S3 connection and shows the Panther settings on the last step. For another SIEM that reads newline-delimited JSON from S3, click Add next to Amazon S3 instead. The steps are the same, without the Panther step.

Enter the connection details

Fill in:

Field	Value
Connection name	Any name, for example `Panther`
Destination name	Any name for this bucket
Region	The bucket’s AWS region, for example `us-east-1`
Bucket	Your S3 bucket name
Prefix	The folder Ultra writes under, for example `exports/ultra`
Encryption	SSE-S3, or SSE-KMS with a KMS key ARN in the same region

Click Continue.

Create the IAM role in AWS

Ultra Hub shows two policies generated for your connection:

A trust policy that lets Ultra assume the role, using an external ID unique to your connection
A permissions policy that allows writing to your bucket and prefix only

In AWS IAM, create a role with the trust policy and attach the permissions policy. Then click I’ve created the role.This role is only for Ultra’s writes. Panther reads the bucket with its own role, which you create in Connect Panther.

If you chose SSE-KMS and your key policy does not delegate access to IAM, also allow this role in the key policy.

Finish setup in Ultra Hub

Paste the new role’s ARN into Customer role ARN and review the summary.

From the Panther tile, click Continue. The Set up Panther step shows the Panther settings for your bucket and prefix. Follow them, or the steps in Connect Panther, then click Finish setup.
From the Amazon S3 tile, click Finish setup.

Ultra creates the connection with its alert stream disabled, so nothing is delivered until you enable it in the last step. If you leave before finishing, open the connection and click Resume setup.

Connect Panther

Next, point Panther at the same bucket, then turn on delivery.

Add the Ultra schema in Panther

In Panther, go to Schemas and click Create New. Set:

Setting	Value
Schema ID	`Custom.Ultra.Alert.V1`
Description	`Ultra Hub alerts delivered to S3`
Field Discovery	Off

Under Schema, click Start on Create your schema from scratch, keep the Default (JSON/XML) parser, and paste this into Fields & Indicators:

fields:
  - name: schema_version
    required: true
    type: bigint
  - name: record_type
    required: true
    type: string
    validate:
      allow: [alert]
  - name: record_id
    required: true
    type: string
  - name: observed_at
    required: true
    type: timestamp
    timeFormats:
      - rfc3339
    isEventTime: true
  - name: exported_at
    required: true
    type: timestamp
    timeFormats:
      - rfc3339
  - name: data
    required: true
    type: object
    fields:
      - name: organization_id
        required: true
        type: string
      - name: workspace_id
        required: false
        type: string
      - name: gateway_id
        required: false
        type: string
      - name: title
        required: true
        type: string
      - name: description
        required: true
        type: string
      - name: severity
        required: true
        type: string
        validate:
          allow: [critical, high, medium, low, informational]
      - name: source_type
        required: true
        type: string
        validate:
          allow: [guardrail, anomaly, policy, system, supply_chain, governance]
      - name: source_id
        required: false
        type: string
      - name: context_type
        required: false
        type: string
      - name: context_id
        required: false
        type: string
      - name: context_label
        required: false
        type: string
      - name: aggregate_count
        required: true
        type: bigint
      - name: first_seen_at
        required: true
        type: timestamp
        timeFormats:
          - rfc3339
      - name: last_seen_at
        required: true
        type: timestamp
        timeFormats:
          - rfc3339
      - name: recommended_action
        required: false
        type: string
      - name: enforcement_event_id
        required: false
        type: string
      - name: outcome
        required: false
        type: string
      - name: guardrail_slug
        required: false
        type: string
      - name: principal
        required: false
        type: string
      - name: user_id
        required: false
        type: string
      - name: user_email
        required: false
        type: string
      - name: method
        required: false
        type: string
      - name: trace_id
        required: false
        type: string
  - name: synthetic
    required: false
    type: boolean

Click Run Test, then Save.

Add the S3 log source in Panther

In Panther, go to Configure > Log Sources, click Create New, and choose AWS S3 Bucket. Enter the AWS account ID that owns the bucket, the bucket name, and your KMS key ARN if you use SSE-KMS, then set:

Setting	Value
S3 prefix	`<prefix>/ultra/v1/`
Schema	`Custom.Ultra.Alert.V1`
Stream type	`Lines`

Use the CloudFormation or Terraform template Panther provides to create its read-only role and the bucket notifications. See Panther’s S3 source guide for details.

If you use SSE-KMS, give Panther’s read-only role kms:Decrypt and kms:DescribeKey on the same key, including in the key policy. Don’t add decrypt access to the role Ultra writes with.

Enable delivery and send a test

In Ultra Hub, open your connection under Settings > Integrations, expand the destination, and click Enable on its alert stream.To confirm everything works, open Configuration from the Alerts page and click Test on any alert source. The test alert appears in Panther with synthetic set to true.

Alert Fields

Each line in an exported file is one alert:

Field	Description
`record_id`	Alert ID
`observed_at`	When the alert was raised. Panther uses this as the event time.
`exported_at`	When Ultra delivered the file
`synthetic`	`true` for test alerts sent from Alerts configuration
`data.title`, `data.description`	Alert title and description
`data.severity`	`critical`, `high`, `medium`, `low`, or `informational`
`data.source_type`	`guardrail`, `anomaly`, `policy`, `system`, `supply_chain`, or `governance`
`data.workspace_id`, `data.gateway_id`	Workspace and device the alert came from
`data.context_type`, `data.context_id`, `data.context_label`	The connector, tool, device, or user the alert is about
`data.aggregate_count`, `data.first_seen_at`, `data.last_seen_at`	How many times it occurred, and when
`data.recommended_action`	Suggested next step
`data.outcome`, `data.guardrail_slug`, `data.method`	What was enforced, by which guardrail, on which MCP method
`data.principal`, `data.user_id`, `data.user_email`	The agent and user involved
`data.trace_id`, `data.enforcement_event_id`	Links to the matching trace and audit log event

Optional fields are left out when empty, but synthetic is always present as true or false. Values are exported as-is, including user emails.

Manage the Connection

Open the connection from Settings > Integrations.

Pause delivery: click Disable on the destination’s Alert stream. Deliveries already accepted still finish. Alerts raised while the stream is disabled are not sent when you enable it again.
Delivery history: in the stream’s menu, choose History.
Delete a destination: in the destination’s menu, choose Delete destination. Ultra then shows a replacement permissions policy under Update AWS permissions. Apply it to your AWS role, then click Done.
Delete the connection: in the connection’s menu, choose Delete connection. This also deletes its destinations, streams, and delivery history. Ultra can’t change your AWS role, so remove the trust and permissions policies from it yourself.

Getting Started

Ultra Hub

Observability

Concepts

SIEM Export (Panther)

What You Get

Prerequisites

Connect Amazon S3

Connect Panther

Alert Fields

Manage the Connection

See Also

​What You Get

​Prerequisites

​Connect Amazon S3

​Connect Panther

​Alert Fields

​Manage the Connection

​See Also

What You Get

Prerequisites

Connect Amazon S3

Connect Panther

Alert Fields

Manage the Connection

See Also