Skip to content
Docs

Drain Audit Logs to Panther

Audit Log Drains are available on Enterprise plans

Audit Log Drains can forward team activity events to Panther using Panther's built-in Vercel source. Use this setup to ingest audit logs into Panther for security monitoring, compliance review, and threat detection.

The Panther destination sends Audit Log Drain events as JSON to the HTTP Source URL that Panther generates. Vercel authenticates each request with the source's Bearer token, and Panther ingests the events as the Vercel.Audit log type.

Getting started with Audit Logs to Panther

Before you configure the drain, make sure you have:

  1. Create a Vercel source in Panther

    • In the Panther Console, open Log Sources, click Create New, search for Vercel, and select the Vercel source.
    • Click Start Setup, then enter a name for the source. Panther sets the log type to Vercel.Audit and the authentication method to Bearer.

    Generate a Bearer token and save it in a secure location. Click Setup, wait for Panther to create the endpoint, then copy the HTTP Source URL from the source details.

  2. Configure the drain in Vercel

    In the Vercel dashboard, go to Team Settings > Drains, click Add Drain, and choose Audit Log as the data type.

    Enter a name for the drain, select Panther as the destination, and configure these fields:

    • Webhook URL: Paste the HTTP Source URL from Panther.
    • Token: Paste the generated Bearer token without the Bearer prefix. Vercel adds the prefix to the Authorization header.

    Click Test to send an example event to Panther. A successful test confirms that the source URL and token are valid.

  3. Create and verify the drain

    Click Create Drain to begin forwarding team activity events. In Panther, open the Vercel log source and verify that Vercel.Audit events arrive.

Configuration reference

FieldDescriptionExample
Webhook URLThe HTTP Source URL that Panther generates for the Vercel source.https://logs.your_panther_domain_here/http/your_source_id_here
TokenThe Bearer token that Panther generates for the source.your_panther_token_here

Format

Vercel sends the standard Audit Log Drain JSON format to the Panther HTTP Source URL over HTTPS and sets the Authorization header to Bearer <token>.

See the Audit Log Drains reference for delivery details and the underlying audit log schema.

More resources

Last updated August 7, 2026
Previous
Drain Audit Logs to Datadog
Next
Reference / Logs

Was this helpful?

supported.