Knowledge BaseRelease NotesRequest Demo

Snowflake Audit Logs

Panther supports pulling Audit Logs directly from Snowflake's ACCOUNT_USAGE schema

Overview

Panther can fetch Snowflake audit information by querying the views in the ACCOUNT_USAGE schema in the SNOWFLAKE database (or similarly named views in a custom database/schema). Data from these views can be enriched with "state data" in Snowflake—learn more on Snowflake Enrichment.

You can use this integration to monitor any Snowflake instance, however, to monitor your Panther-connected Snowflake instance, it's recommended to instead use Scheduled Searches—see Scheduled Search Examples.

Databases in any Snowflake cloud or region may be monitored, but these factors could affect generated cost.

The available views include:

The ACCESS_HISTORY view requires the Enterprise Edition of Snowflake or higher.

Latency

Total data latency is a combination of Snowflake and Panther latency:

  • Latency varies for each of the available Snowflake views, and can, in certain cases, be as high as three hours. To verify latency for each view, consult the Latency column of the ACCOUNT_USAGE views table in this Snowflake documentation.

  • Panther adds at least one hour of latency.

Cost considerations

Snowflake compute costs incurred by using this integration are affected by various factors, including:

  • The warehouse you select for Panther to use

    • Panther must execute queries to pull data, thus it needs to use an active warehouse.

    • You can minimize costs by: selecting a warehouse that is already running.

  • The data refresh interval

    • When setting up the log source in Panther, you will choose how often you'd like to pull data from Snowflake. This can be as frequent as every one minute, up to as long as every 24 hours. You should set this interval based on your desired latency-to-cost balance.

    • You can minimize costs by: choosing a longer refresh interval.

  • Whether the cloud and region of the Snowflake instance you're monitoring is the same as your Panther Snowflake instance

    • You can minimize costs by: the cloud and region being the same as your Panther Snowflake instance.

Learn more on Snowflake's Understanding overall cost documentation.

Limitations

Snowflake Audit log events that exceed Panther's limit of 15 MB will be skipped.

How to onboard Snowflake Audit Logs to Panther

Note that after you've set up the initial integration, you can rotate the RSA key associated to your Snowflake user.

Prerequisites

To configure this integration, you must:

  • Have your Snowflake account identifier. It should be formatted with a hyphen (not a period), like: <org_name>-<account_name>

  • Have a Snowflake warehouse Panther can use to execute queries to pull data

  • In Snowflake, have CREATE USER , CREATE ROLE, and GRANT USAGE permissions

    • This is only required if you will be creating a service user in Snowflake for Panther to use. If you already have a service user Panther can use, you do not need to have these permissions.

Step 1: Create a worksheet in Snowsight

This step is only required if you need to create a service user in Snowflake that Panther can use to pull data. If you already have a service user Panther can use, skip this step.

  • In Snowsight, create a worksheet with the CREATE USER , CREATE ROLE, and GRANT USAGE permissions.

Step 2: Create a new Snowflake log source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for “Snowflake Audit Logs,” then click its tile.

  4. On the slide-out panel, click Start Setup.\

    An arrow is drawn from a tile titled "Snowflake Audit Logs" to a button labeled "Start Setup."

  5. On the Configure page, enter values for the following fields:

    • Name: Enter a descriptive name for the source, e.g. Snowflake Prod.

    • Account Identifier: Enter your Snowflake account identifier in the format <org_name>-<account_name>.

      • Use a hyphen, not a period, between the org and account names.

    • Warehouse: Enter the Snowflake warehouse Panther will use to execute queries to pull data.

    • (Optional) Use custom database and schema: If you have replicated audit log views in a custom database and schema and would like to query those (instead of the default database, SNOWFLAKE, and schema, ACCOUNT_USAGE), click this option.

      • Database: Enter the name of the custom database Panther will query.

      • Schema: Enter the name of the custom schema Panther will query. * Run Every: Use the Number and Period fields to choose the interval on which you'd like Panther to pull data from Snowflake.

    • See Cost considerations to learn about how the interval can affect compute costs.

    • Monitored Log Types: Select the Snowflake views you'd like Panther to fetch.

Using a custom database and schema is rare. Doing so may appeal to you if you'd like to narrow the permissions of the service role you'll create in a later step to a certain Snowflake database and schema of your own. If you use a custom database and schema, the names of the views within the schema must exactly match the built-in Snowflake view names (listed in the Overview), as these are the names Panther expects. For example, if you'd like to pull query history logs, your view must be named query_history.

  1. Click Setup.

  2. On the Set Credentials page, fill in the form fields. Panther will generate an RSA key based on these values.

    • Username: The username of the Snowflake user Panther will use to pull data. The default value is PANTHER_AUDIT_VIEW_USER, but you may customize this.

      • If you already have a service user for Panther to use (and don't need to create a new one), enter its username here.

    • Role: The name of the role possessed by the Snowflake user that Panther will use to pull data. The default value is PANTHER_AUDIT_VIEW_ROLE, but you may customize this.

      • If you already have a service role for Panther to use (and don't need to create a new one), enter its name here.

  3. If you already have a service user for Panther to use (and don't need to create a new one), click I want to use my own RSA key, then upload your RSA key file.

  4. Click Next.

  5. On the Enrichment page, if you'd like to enrich incoming logs with one or more of the supported Snowflake enrichment types, on the tile of each one that you'd like to enable, click the toggle ON and set the Refresh period (min).

    • The minimum refresh period is 60 minutes. If your data changes infrequently, it's recommended to increase this value.

    • If you toggle any of these enrichment sources on, they will be visible on the Configure > Enrichments page. Learn more on Snowflake Enrichment.

    Under an "Enrichment settings" title, there are six tiles, each with a title, description, an ON/OFF toggle, and a Refresh period (min) field.

  6. Click Setup.

  7. If you did not upload your own RSA key, create a service user for Panther to use with the generated SQL snippet. Panther generates an RSA key on your behalf and only surfaces the public portion.

    1. Copy the generated SQL snippet.

    2. Run the SQL snippet in a Snowsight worksheet.

    3. Click Setup.

  8. If everything is correct, you will be directed to a success screen:

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.\

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

How to rotate the RSA key of an existing Snowflake Audit Logs source

To rotate the RSA key associated with a Snowflake user connected to an existing Snowflake Audit Logs source—without interrupting the incoming flow of logs:

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. In the Log Sources list, locate the Snowflake Audit logs source you'd like to update, and click its name.

  3. On the log source's details page, click the Configuration tab, then Edit.\

    Under a "Snowflake audit logs source," an arrow is drawn from a "Configuration" tab to an "Edit" button.

  4. Click Set Credentials.

  5. Click Rotate RSA Key.

    An arrow is drawn from a "Set Credentials" button to a "Rotate RSA Key" button.

  6. On the Rotate RSA Key pop-up modal, click Rotate RSA Key.

  7. Copy the provided RSA Key Rotation SQL, and run it in a Snowsight worksheet (using a privileged user, like ACCOUNTADMIN).

  8. In Panther, click Save.

Supported log types

Snowflake.AccessHistory

Snowflake.DataTransferHistory

Snowflake.LoginHistory

Snowflake.QueryHistory

Snowflake.Sessions

PreviousSlack LogsNextSnyk Logs

Last updated

Was this helpful?