Get phone and SMS alerts fromPanther
Panther is a cloud-native SIEM that runs detections over your security logs and raises an alert the moment a rule matches. Spike turns every Panther alert into an incident and pages the on-call engineer — by phone, SMS, Slack, or email — escalating until someone acknowledges it.
Set up with AI
I use Panther for monitoring and Spike for on-call and incident management. Walk me through connecting them: create a Panther integration in Spike, copy its webhook URL, and add that webhook to Panther alert settings. Then help me send a test alert to confirm incidents show up in Spike.
What is Panther?
Panther is a cloud-native SIEM built on a security data lake. It streams logs from AWS, Okta, GitHub, CrowdStrike, and dozens of other sources into a warehouse, then runs detections-as-code over them — Python rules, scheduled rules, policies, and correlation rules that flag a privilege escalation, an anomalous login, a public S3 bucket, or a cloud resource drifting out of compliance. Each match becomes an alert with its own severity, from INFO through CRITICAL.
Panther’s own destinations can post those alerts to Slack or email, neither of which reliably reaches someone who has stepped away from their desk. Routed to Spike through a Custom Webhook destination, each detection becomes an incident instead: the on-call security engineer gets a phone call and SMS within seconds, the alert’s severity decides how hard Spike pushes, and an unacknowledged CRITICAL climbs the escalation policy until a human answers. The detection’s title comes through verbatim, and its runbook and Panther link ride along on the incident, so whoever picks up the page starts with the context and the next step already in front of them.
How to set up Panther alerts
Every Spike integration is a unique webhook URL. Paste it into Panther and alerts start flowing — no agents, no code.
Step 1: Create a Panther integration in Spike
In your Spike dashboard, open Integrations and choose Panther. Spike generates a unique webhook URL for this integration — copy it.
Step 2: Add a Custom Webhook destination in Panther
In Panther, open Configuration → Alert Destinations and add a Custom Webhook. Paste the Spike webhook URL, give the destination a name, and add custom headers if your setup needs them.
Step 3: Choose which alerts route to Spike
On the same destination, set the severity, alert-type, and log-type filters so only the detections worth waking someone for reach Spike — CRITICAL and HIGH to the pager, the quieter severities somewhere else.
Step 4: Send a test alert
Use Panther's Send Test Alert button on the destination. The test alert lands in Spike as an incident within seconds and pages whoever is on call.
Step 5: Set a resolve timer
Panther doesn't notify webhooks when an alert is triaged or closed, so nothing arrives to close the incident. Set the integration's resolve timer in Spike and incidents close themselves once the window passes.
That's it — Panther alerts now page whoever is on call.
