Knowledge BaseRelease NotesRequest Demo

Snowflake Audit Logs (Beta)

Panther supports pulling Audit Logs directly from Snowflake's ACCOUNT_USAGE schema

Overview

This feature is in open beta starting with Panther version 1.111, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther can fetch Snowflake audit information by querying the views in the ACCOUNT_USAGE schema in the SNOWFLAKE database.

You can use this integration to monitor the Snowflake instance connected to your Panther instance or any other Snowflake instance. (It's also possible to monitor the Snowflake account associated to your Panther instance using Scheduled Searches—see Scheduled Search Examples.) Databases in any Snowflake cloud or region may be monitored, but these factors could affect generated cost.

The available views include:

The ACCESS_HISTORY view requires the Enterprise Edition of Snowflake or higher.

When setting up the log source in Panther, you will choose how often you'd like to pull data from Snowflake. Immediately after log source creation, the GRANTS_TO_ROLES,GRANTS_TO_USERS, and USERS views are backfilled, then refreshed whenever data is re-pulled. The other views are pulled immediately after log source creation (looking back one hour), then new changes are pulled on the configured schedule.

Latency

Total data latency is a combination of Snowflake and Panther latency:

  • Latency varies for each of the available Snowflake views, and can, in certain cases, be as high as three hours. To verify latency for each view, consult the Latency column of the ACCOUNT_USAGE views table in this Snowflake documentation.

  • Panther adds at least one hour of latency.

Cost considerations

Snowflake compute costs incurred by using this integration are affected by various factors, including:

  • The warehouse you select for Panther to use

    • Panther must execute queries to pull data, thus it needs to use an active warehouse.

    • You can minimize costs by: selecting a warehouse that is already running.

  • The data refresh interval

    • When setting up the log source in Panther, you will choose how often you'd like to pull data from Snowflake. This can be as frequent as every one minute, up to as long as every 24 hours. You should set this interval based on your desired latency-to-cost balance.

    • You can minimize costs by: choosing a longer refresh interval.

  • Whether the cloud and region of the Snowflake instance you're monitoring is the same as your Panther Snowflake instance

    • You can minimize costs by: the cloud and region being the same as your Panther Snowflake instance.

Learn more on Snowflake's Understanding overall cost documentation.

How to onboard Snowflake Audit Logs to Panther

Prerequisites

To configure this integration, you must:

  • Have your Snowflake account identifier. It should be formatted with a hyphen (not a period), like: <org_name>-<account_name>

  • Have a Snowflake warehouse Panther can use to execute queries to pull data

  • In Snowflake, have CREATE USER , CREATE ROLE, and GRANT USAGE permissions

    • This is only required if you will be creating a service user in Snowflake for Panther to use (which is an optional part of Step 2). If you already have a service user Panther can use, you do not need to have these permissions.

Step 1: Create a worksheet in Snowsight

This step is only required if you need to create a service user in Snowflake that Panther can use to pull data. If you already have a service user Panther can use, skip this step.

  • In Snowsight, create a worksheet with the CREATE USER , CREATE ROLE, and GRANT USAGE permissions.

Step 2: Create a new Snowflake log source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for “Snowflake Audit Logs,” then click its tile.

  4. On the slide-out panel, click Start Setup.

    An arrow is drawn from a tile titled "Snowflake Audit Logs" to a button labeled "Start Setup."

  5. On the Configure page, enter values for the following fields:

    • Name: Enter a descriptive name for the source, e.g. Snowflake Prod.

    • Account Identifier: Enter your Snowflake account identifier in the format <org_name>-<account_name>.

      • Use a hyphen, not a period, between the org and account names.

    • Warehouse: Enter the Snowflake warehouse Panther will use to execute queries to pull data.

    • Run Every: Use the Number and Period fields to choose the interval on which you'd like Panther to pull data from Snowflake.

    • Monitored Log Types: Select the Snowflake views you'd like Panther to fetch.

  6. Click Setup.

  7. On the Set Credentials page, fill in the form fields:

    • Username: The username of the Snowflake user Panther will use to pull data. The default value is PANTHER_AUDIT_VIEW_USER.

      • If you already have a service user for Panther to use (and don't need to create a new one), enter its username here.

    • Role: The name of the role possessed by the Snowflake user that Panther will use to pull data. The default value is PANTHER_AUDIT_VIEW_ROLE.

      • If you already have a service user for Panther to use (and don't need to create a new one), enter its role name here.

    • Authentication Method: Choose Password or Rsa Key, then enter a password or upload an unencrypted private RSA key file in PEM format.

      • If you already have a service user for Panther to use (and don't need to create a new one), provide its password or unencrypted private RSA key here.

      • If you need to create a service user for Panther's use and you are using the RSA key method, follow these instructions to generate a PKCS8 RSA key according to Snowflake's standards. When creating the private key, create an unencrypted version. Couple the public key with the user as described here.

      • Encrypted private RSA keys are not supported.

  8. If you do not already have a service user for Panther to use, create one using the generated SQL snippet:

    1. Copy the generated SQL snippet.

    2. Update the PASSWORD or RSA_PUBLIC_KEY value.

      • If you are using a password, update the PASSWORD value to match the value you inputted in the form above.

      • If you are using an RSA key, input your public RSA key RSA_PUBLIC_KEY value.

    3. Run the SQL snippet in a Snowsight worksheet.

  9. Click Setup. If everything is correct, you will be directed to a success screen:

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

Supported log types

Snowflake.AccessHistory

Snowflake.DataTransferHistory

Snowflake.GrantsToRoles

Snowflake.GrantsToUsers

Snowflake.LoginHistory

Snowflake.QueryHistory

Snowflake.Sessions

Snowflake.Stages

PreviousSlack LogsNextSnyk Logs

Last updated

Was this helpful?