> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ultra.security/llms.txt
> Use this file to discover all available pages before exploring further.

# SIEM Export (Panther)

> Send Ultra alerts to Panther through S3

Ultra can deliver your organization's alerts to an S3 bucket in your AWS account. Your SIEM reads them from there. This guide connects that bucket to **Panther**, but any tool that reads newline-delimited JSON from S3 can use the same export.

## What You Get

* Every alert Ultra raises, delivered as gzip-compressed NDJSON files (one alert per line)
* Alerts raised from the moment you enable delivery. Earlier alerts are not backfilled.

Ultra can only write to your bucket. It cannot read, list, or delete anything in it.

## Prerequisites

* **Owner or admin** role in Ultra Hub
* An **AWS account** where you can create an S3 bucket and an IAM role
* A **Panther** account with permission to add log sources and schemas

## Connect Amazon S3

First, connect Ultra Hub to your S3 bucket.

<Steps>
  <Step title="Add an S3 connection in Ultra Hub">
    In Ultra Hub, go to **Settings > Integrations**. Under **Available integrations**, click **Add** next to **Amazon S3**.

    Fill in:

    | Field                | Value                                                            |
    | -------------------- | ---------------------------------------------------------------- |
    | **Connection name**  | Any name, for example `Panther`                                  |
    | **Destination name** | Any name for this bucket                                         |
    | **Region**           | The bucket's AWS region, for example `us-east-1`                 |
    | **Bucket**           | Your S3 bucket name                                              |
    | **Prefix**           | The folder Ultra writes under, for example `exports/ultra`       |
    | **Encryption**       | **SSE-S3**, or **SSE-KMS** with a KMS key ARN in the same region |

    Click **Continue**.
  </Step>

  <Step title="Create the IAM role in AWS">
    Ultra Hub shows two policies generated for your connection:

    * A **trust policy** that lets Ultra assume the role, using an external ID unique to your connection
    * A **permissions policy** that allows writing to your bucket and prefix only

    In AWS IAM, create a role with the trust policy and attach the permissions policy. Then click **I've created the role**.

    <Note>
      If you chose SSE-KMS and your key policy does not delegate access to IAM, also allow this role in the key policy.
    </Note>
  </Step>

  <Step title="Finish setup in Ultra Hub">
    Paste the new role's ARN into **Customer role ARN**, review the summary, and click **Finish setup**.

    Ultra creates the connection with its alert stream **disabled**, so nothing is delivered until you enable it in the last step.
  </Step>
</Steps>

## Connect Panther

Next, point Panther at the same bucket, then turn on delivery.

<Steps>
  <Step title="Add the Ultra schema in Panther">
    In Panther, go to **Schemas** and click **Create New**. Set:

    | Setting             | Value                              |
    | ------------------- | ---------------------------------- |
    | **Schema ID**       | `Custom.Ultra.Alert.V1`            |
    | **Description**     | `Ultra Hub alerts delivered to S3` |
    | **Field Discovery** | Off                                |

    Under **Schema**, click **Start** on **Create your schema from scratch**, keep the **Default (JSON/XML)** parser, and paste this into **Fields & Indicators**:

    ```yaml theme={null}
    fields:
      - name: schema_version
        required: true
        type: bigint
      - name: record_type
        required: true
        type: string
        validate:
          allow: [alert]
      - name: record_id
        required: true
        type: string
      - name: observed_at
        required: true
        type: timestamp
        timeFormats:
          - rfc3339
        isEventTime: true
      - name: exported_at
        required: true
        type: timestamp
        timeFormats:
          - rfc3339
      - name: data
        required: true
        type: object
        fields:
          - name: organization_id
            required: true
            type: string
          - name: workspace_id
            required: false
            type: string
          - name: gateway_id
            required: false
            type: string
          - name: title
            required: true
            type: string
          - name: description
            required: true
            type: string
          - name: severity
            required: true
            type: string
            validate:
              allow: [critical, high, medium, low, informational]
          - name: source_type
            required: true
            type: string
            validate:
              allow: [guardrail, anomaly, policy, system, supply_chain, governance]
          - name: source_id
            required: false
            type: string
          - name: context_type
            required: false
            type: string
          - name: context_id
            required: false
            type: string
          - name: context_label
            required: false
            type: string
          - name: aggregate_count
            required: true
            type: bigint
          - name: first_seen_at
            required: true
            type: timestamp
            timeFormats:
              - rfc3339
          - name: last_seen_at
            required: true
            type: timestamp
            timeFormats:
              - rfc3339
          - name: recommended_action
            required: false
            type: string
          - name: enforcement_event_id
            required: false
            type: string
          - name: outcome
            required: false
            type: string
          - name: guardrail_slug
            required: false
            type: string
          - name: principal
            required: false
            type: string
          - name: user_id
            required: false
            type: string
          - name: user_email
            required: false
            type: string
          - name: method
            required: false
            type: string
          - name: trace_id
            required: false
            type: string
      - name: synthetic
        required: false
        type: boolean
    ```

    Click **Run Test**, then **Save**.
  </Step>

  <Step title="Add the S3 log source in Panther">
    In Panther, go to **Configure > Log Sources**, click **Create New**, and choose **AWS S3 Bucket**. Enter the AWS account ID that owns the bucket, the bucket name, and your KMS key ARN if you use SSE-KMS, then set:

    | Setting         | Value                   |
    | --------------- | ----------------------- |
    | **S3 prefix**   | `<prefix>/ultra/v1/`    |
    | **Schema**      | `Custom.Ultra.Alert.V1` |
    | **Stream type** | `Lines`                 |

    Use the CloudFormation or Terraform template Panther provides to create its read-only role and the bucket notifications. See [Panther's S3 source guide](https://docs.panther.com/data-onboarding/data-transports/aws/s3) for details.
  </Step>

  <Step title="Enable delivery and send a test">
    In Ultra Hub, open your connection under **Settings > Integrations**, expand the destination, and click **Enable** on its alert stream.

    To confirm everything works, open **Configuration** from the Alerts page and click **Test** on any alert source. The test alert appears in Panther with `synthetic` set to `true`.
  </Step>
</Steps>

## Alert Fields

Each line in an exported file is one alert:

| Field                                                             | Description                                                                 |
| ----------------------------------------------------------------- | --------------------------------------------------------------------------- |
| `record_id`                                                       | Alert ID                                                                    |
| `observed_at`                                                     | When the alert was raised. Panther uses this as the event time.             |
| `exported_at`                                                     | When Ultra delivered the file                                               |
| `synthetic`                                                       | `true` for test alerts sent from Alerts configuration                       |
| `data.title`, `data.description`                                  | Alert title and description                                                 |
| `data.severity`                                                   | `critical`, `high`, `medium`, `low`, or `informational`                     |
| `data.source_type`                                                | `guardrail`, `anomaly`, `policy`, `system`, `supply_chain`, or `governance` |
| `data.workspace_id`, `data.gateway_id`                            | Workspace and device the alert came from                                    |
| `data.context_type`, `data.context_id`, `data.context_label`      | The connector, tool, device, or user the alert is about                     |
| `data.aggregate_count`, `data.first_seen_at`, `data.last_seen_at` | How many times it occurred, and when                                        |
| `data.recommended_action`                                         | Suggested next step                                                         |
| `data.outcome`, `data.guardrail_slug`, `data.method`              | What was enforced, by which guardrail, on which MCP method                  |
| `data.principal`, `data.user_id`, `data.user_email`               | The agent and user involved                                                 |
| `data.trace_id`, `data.enforcement_event_id`                      | Links to the matching trace and audit log event                             |

Optional fields are left out when empty. Values are exported as-is, including user emails.

## See Also

* [Alerts](/observability/alerts)
* [Audit Log](/observability/audit-log)
* [OTLP Export](/observability/otlp-export)