Snowflake enrichment is in open beta starting with Panther version 1.113, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
You can create Snowflake Lookup Tables in Panther by configuring your to pull tables containing "state" data (unlike the tables read by the log source itself, which contain time-series security data). This means you can reference this information in detection logic and search queries.
Snowflake enrichment data is refreshed on the same interval as the one you configure your Snowflake Audit log source to pull logs on.
After setting up Snowflake enrichment, to view the stored enrichment data, follow .
How incoming logs are enriched with Snowflake data
After you for a , incoming logs (parsed by any schema) will be enriched with Snowflake data if matches are found according to .
How to set up Snowflake enrichment in Panther
You can configure Snowflake enrichment while you are initially setting up your log source integration in Panther, or later, by editing the source. During either flow, on the Enrichment page, you'll toggle on your desired .
In order to enable these, you must first (or concurrently) . It is not possible to set up Snowflake enrichment without onboarding Snowflake as a log source in Panther.
Configure Snowflake enrichment in Panther during Snowflake Audit source setup
Follow , paying close attention to the Enrichment page.
Configure Snowflake enrichment in Panther after the initial Snowflake Audit source setup
In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.
Locate the Snowflake Audit log source for which you'd like to set up enrichment, and click its name.
In the upper-right corner, click Enrichment.
Click Save.
Supported enrichment types
Snowflake.Users
schema: Snowflake.Users
description: Snowflake Users
referenceURL: https://docs.snowflake.com/en/sql-reference/account-usage/users
fields:
- name: match
description: match of the LUT
type: array
element:
type: string
- name: BYPASS_MFA_UNTIL
description: Timestamp until which multi-factor authentication is bypassed
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: COMMENT
description: Comment for the user
type: string
- name: CREATED_ON
required: true
description: Timestamp when the user was created
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DEFAULT_NAMESPACE
description: Default namespace assigned to the user
type: string
- name: DEFAULT_ROLE
description: Default role assigned to the user
type: string
- name: DEFAULT_SECONDARY_ROLE
description: Specifies the default secondary role for the user (i.e. ALL) or NULL if not set
type: string
- name: DEFAULT_WAREHOUSE
description: Default warehouse assigned to the user
type: string
- name: DELETED_ON
description: Timestamp of when the user was deleted (if deleted)
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DISABLED
description: Indicates whether the user is disabled
type: boolean
- name: DISPLAY_NAME
description: Display name of the user
type: string
- name: EMAIL
description: Email address of the user
type: string
indicators:
- email
- name: EXT_AUTHN_DUO
description: Indicates if external authentication via Duo is enabled
type: boolean
- name: EXT_AUTHN_ID
description: The authorization ID used for Duo Security
type: string
- name: EXPIRES_AT
description: The date and time when the user status is set to EXPIRED and the user can no longer log in
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: FIRST_NAME
description: First name of the user
type: string
- name: LAST_NAME
description: Last name of the user
type: string
- name: HAS_MFA
description: Indicates if the user has multi-factor authentication enabled
type: boolean
- name: HAS_PASSWORD
description: Indicates if the user has a password set
type: boolean
- name: HAS_RSA_PUBLIC_KEY
description: Indicates if the user has an RSA public key set
type: boolean
- name: LAST_SUCCESS_LOGIN
description: Timestamp of the last successful login
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: LOCKED_UNTIL_TIME
description: Timestamp of when the user will be unlocked (if locked)
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: LOGIN_NAME
description: Login name of the user
type: string
- name: MUST_CHANGE_PASSWORD
description: Indicates if the user must change their password
type: boolean
- name: NAME
required: true
description: Name of the user
type: string
indicators:
- username
- name: OWNER
description: Owner of the user account
type: string
- name: PASSWORD_LAST_SET_TIME
description: The timestamp on which the last non-null password was set for the user. Defaults to null if no password has been set
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: SNOWFLAKE_LOCK
description: Indicates if the user is locked in Snowflake
type: boolean
- name: TYPE
description: 'Specifies the type of user. PERSON, SERVICE, LEGACY_SERVICE, or NULL. Default: NULL'
type: string
- name: USER_ID
required: true
description: Unique identifier for the user
type: string
Snowflake.Roles
schema: Snowflake.Roles
description: Information about all roles defined in the Snowflake account
referenceURL: https://docs.snowflake.com/en/sql-reference/account-usage/roles
fields:
- name: match
description: Match for lookups, matches ROLE_ID, ROLE_INSTANCE_ID, and NAME
type: array
element:
type: string
- name: ROLE_ID
required: true
description: Internal/system-generated identifier for the role
type: string
- name: CREATED_ON
required: true
description: Date and time (in the UTC time zone) when the role was created
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DELETED_ON
description: Date and time (in the UTC time zone) when the role was deleted
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: NAME
required: true
description: Name of the role
type: string
- name: COMMENT
description: Comment for the role
type: string
- name: OWNER
description: Role with the OWNERSHIP privilege on the object
type: string
- name: ROLE_TYPE
description: Either ROLE, DATABASE_ROLE, or INSTANCE_ROLE
type: string
- name: ROLE_DATABASE_NAME
description: Name of the database that contains the database role if the role is a database role
type: string
- name: ROLE_INSTANCE_ID
description: Internal/system-generated identifier for the class instance that the role belongs to
type: string
- name: OWNER_ROLE_TYPE
description: The type of role that owns the object, for example ROLE. If a Snowflake Native App owns the object, the value is APPLICATION. Snowflake returns NULL if you delete the object because a deleted object does not have an owner role
type: string
Snowflake.GrantsToUsers
schema: Snowflake.GrantsToUsers
description: Snowflake Grants to Users
referenceURL: https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users
fields:
- name: match
description: Match field for lookups
type: array
element:
type: string
- name: CREATED_ON
required: true
description: Time and date (in the UTC time zone) when the role is granted
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DELETED_ON
description: Time and date (in the UTC time zone) when the role is revoked
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: GRANTED_BY
description: Identifier for the role that granted the privilege
type: string
- name: GRANTED_TO
required: true
description: For this log type, the value is USER
type: string
- name: GRANTEE_NAME
required: true
description: Name of the user to whom the privilege is granted
type: string
indicators:
- username
- name: ROLE
required: true
description: Identifier for the role granted to the user
type: string
Snowflake.GrantsToRoles
schema: Snowflake.GrantsToRoles
description: Snowflake Grants to Roles
referenceURL: https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_roles
fields:
- name: match
description: Match field for lookups
type: array
element:
type: string
- name: CREATED_ON
required: true
description: Date and time (in the UTC time zone) when the privilege is granted to the role
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DELETED_ON
description: Date and time (in the UTC time zone) when the privilege is revoked
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: GRANTED_BY
description: Identifier for the role that granted the privilege, or the name of the Snowflake Native App object when there are grants to an application role
type: string
indicators:
- username
- name: GRANTED_BY_ROLE_TYPE
description: Either APPLICATION, ROLE or DATABASE_ROLE
type: string
- name: GRANTED_TO
required: true
description: Either ROLE, DATABASE_ROLE, INSTANCE_ROLE, APPLICATION_ROLE, or APPLICATION
type: string
- name: GRANTED_ON
required: true
description: Object kind, such as TABLE or DATABASE, on which the privilege is granted
type: string
- name: GRANTEE_NAME
required: true
description: Identifier for the recipient role, the role to which the privilege is granted, or the name of the Snowflake Native App object
type: string
indicators:
- username
- name: GRANT_OPTION
description: If set to TRUE, the recipient role can grant the privilege to other roles
type: boolean
- name: MODIFIED_ON
description: Date and time (in the UTC time zone) when the privilege is updated
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: NAME
description: Name of the object on which the privilege is granted
type: string
- name: PRIVILEGE
description: Name of the privilege added to the role
type: string
- name: TABLE_CATALOG
description: Name of the database for the current table or the name of the database that stores the instance of a class
type: string
- name: TABLE_SCHEMA
description: Name of the schema for the current table or the name of the schema that stores the instance of a class
type: string
- name: OBJECT_INSTANCE
description: The fully-qualified name of the object that contains the instance role for a particular class in the format database.schema.class
type: json
Snowflake.Stages
schema: Snowflake.Stages
description: Snowflake Stages
referenceURL: https://docs.snowflake.com/en/sql-reference/account-usage/stages
fields:
- name: match
description: match of the LUT
type: array
element:
type: string
- name: CREATED
required: true
description: Timestamp when the stage was created
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DELETED
description: Timestamp when the stage was deleted
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: INSTANCE_ID
description: Internal/system-generated identifier for the instance which the object belongs to
type: string
- name: LAST_ALTERED
description: Timestamp when the stage was last altered
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: OWNER_ROLE_TYPE
description: The type of role that owns the object, for example ROLE. If a Snowflake Native App owns the object, the value is APPLICATION
type: string
- name: STAGE_CATALOG
description: Catalog where the stage resides
type: string
- name: STAGE_CATALOG_ID
required: true
description: Unique identifier for the stage catalog
type: string
- name: STAGE_ID
required: true
description: Unique identifier for the stage
type: string
- name: STAGE_NAME
required: true
description: Name of the stage
type: string
- name: STAGE_REGION
description: Region where the stage is located
type: string
- name: STAGE_SCHEMA
description: Schema where the stage resides
type: string
- name: STAGE_OWNER
description: Name of the role that owns the stage; NULL if it has been dropped
type: string
- name: COMMENT
description: Comment for this stage. NULL if no comment is provided
type: string
- name: STAGE_SCHEMA_ID
required: true
description: Unique identifier for the stage schema
type: string
- name: STAGE_TYPE
description: Type of the stage (e.g., External Named)
type: string
- name: STAGE_URL
description: URL of the stage
type: string
- name: STORAGE_INTEGRATION
description: Storage integration associated with the stage
type: string
Snowflake.NetworkPolicies
schema: Snowflake.NetworkPolicies
description: Snowflake Network Policies
referenceURL: https://docs.snowflake.com/en/sql-reference/account-usage/network_policies
fields:
- name: match
description: ID of the network policy for matching
type: array
element:
type: string
- name: ID
required: true
description: Internal system-generated identifier for network policy
type: string
- name: NAME
required: true
description: Network policy name
type: string
- name: OWNER
description: Name of the role that owns the network policy
type: string
- name: OWNER_ROLE_TYPE
description: The type of role that owns the object, for example ROLE. If a Snowflake Native App owns the object, the value is APPLICATION. Snowflake returns NULL if you delete the object because a deleted object does not have an owner role
type: string
- name: COMMENT
description: Comment for the network policy (if any)
type: string
- name: CREATED
description: Date and time that the network policy was created
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: LAST_ALTERED
required: true
description: Date and time that the network policy was last altered
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: DELETED
description: Date and time the network policy was dropped
type: timestamp
timeFormats:
- '%Y-%m-%d %H:%M:%S.%f %z'
- '%a, %d %b %Y %H:%M:%S %z'
- name: ALLOWED_IP_LIST
description: List of allowed IPv4 addresses and CIDR block ranges in the corresponding network policy
type: array
element:
type: string
- name: BLOCKED_IP_LIST
description: List of blocked IPv4 addresses and CIDR block ranges in the corresponding network policy
type: array
element:
type: string
You can set up Snowflake enrichment after you've already created a log source in Panther by editing it:
In the upper-right corner of the log source page, click Configuration, then Edit.
Under Enrichment settings, on the tile of each of the you'd like to enable, click the toggle ON.
Panther supports pulling various tables from the Snowflake . Below are the schemas for how the data for each enrichment type is structured.