Repository navigation
[New Integration] Snowflake #11617
Description
Description
The Snowflake integration enables organizations to monitor and detect security threats within their Snowflake platform. By ingesting security-relevant logs and metrics from Snowflake's various monitoring tables, the integration provides comprehensive visibility into potentially suspicious activities across the Snowflake instance.
Architecture
- The integration collects data from the following tables:
- SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
- SNOWFLAKE.ACCOUNT_USAGE.SESSIONS
- SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS
- SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY
- SNOWFLAKE.ACCOUNT_USAGE.DATA_TRANSFER_HISTORY
- SNOWFLAKE.ACCOUNT_USAGE.STAGES
- SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
- SNOWFLAKE.ACCOUNT_USAGE.EXTERNAL_ACCESS_HISTORY
- Event tables
Snowflake data can be loaded to Elastic via Snowflake's SQL API
Dashboard Ideas
The dashboard should provide answers to questions about user data warehouse security posture, user activities and potential threats. It should enable real-time monitoring of access patterns, authentication attempts, and data usage across the Snowflake environment. These are a few key categories, and suggestions for potential charts which satisfy each category:
-
Authentication & access overview
- Line graph showing login attempts over time
- Geo map of login locations and suspicious access patterns
- Heat map showing login activity by time of day/week
- Counter showing total active sessions and failed login attempts in last 24h
-
User activity
- Table of top users by query volume
- Chart showing resource consumption by user/role
- Timeline of user permission changes
- Suspicious activity indicators (off-hours access, unusual query patterns)
-
Data access patterns
- Bar chart of most frequently accessed tables/views
- Line graph showing data transfer volume trends
- Table of external data access events
- Alerts for unusual data access volumes or patterns
- Alerts on unauthorized stage access attempts
-
Query analysis & security
- Chart showing distribution of query types
- Timeline of sensitive data access events
- Table of failed queries that might indicate attempted abuse
- Metrics on query performance and resource utilization
Integration release checklist
This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.
All changes
- Change follows the contributing guidelines
- Supported versions of the monitoring target are documented
- Supported operating systems are documented (if applicable)
- Integration or System tests exist
- Documentation exists, useful guidelines to follow
- Fields follow ECS and naming conventions
- At least a manual test with ES / Kibana / Agent has been performed.
- Required Kibana version set to:
Activity
[-][New Integration] [WIP] Snowflake[/-][+][New Integration] Snowflake[/+]botelastic commentedon Dec 30, 2025
Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as
Staleto make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough:+1. Thank you for your contribution!SamerHammer commentedon Jul 30, 2026
Is there an ETA on this integration?
chrisberkhout commentedon Aug 3, 2026
@jamiehynds
infra-vault-gh-plugin-prod commentedon Sep 21, 2026
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
terrancedejesus commentedon Sep 29, 2026
Thanks for the ping @jamiehynds - will review some in-the-wild attacks and determine if scope expansion can help threat detection use cases.
Update
I'd add these as well:
Reviewed the in-the-wild activity against the tables already listed. UNC5537 (Mandiant, 2024; later charged as Moucka and Binns) is covered by the current set. Password login without MFA, client application (
rapeflake/ FROSTBITE, DBeaver, SnowSQL, JDBC), thenSHOW/SELECT/LIST,CREATE TEMPORARY STAGE,COPY INTO, andGET. Those land inLOGIN_HISTORY,SESSIONS, andQUERY_HISTORY.These eight are the gap for what that same access does next:
USERSrecords the backdoor user, password reset, RSA key-pair (HAS_RSA_PUBLIC_KEY), programmatic access token (HAS_PAT), userTYPE, andBYPASS_MFA_UNTIL.LOGIN_HISTORYshows the password success. It does not show that MFA was waived or that a key or token was planted for the next session.GRANTS_TO_ROLESrecords object privileges (SELECT,USAGE,CREATE STAGE,CREATE INTEGRATION).GRANTS_TO_USERSonly records which role a user holds, not what that role can read.SHARESrecords an outbound direct share.TARGET_ACCOUNTSis the consumer account list. This path does not write a stage and does not appear inDATA_TRANSFER_HISTORY.GRANTS_TO_SHARESrecords the databases, schemas, tables, and views granted to that share.LISTING_ACCESS_HISTORYrecords consumer queries against a listing. Those queries never appear in the provider account'sQUERY_HISTORY. This view is inDATA_SHARING_USAGE, notACCOUNT_USAGE.TASK_HISTORYrecords a scheduled task that repeatsCOPY INTOor an external-access call. The child statement is inQUERY_HISTORY, but it is not marked as a task, so it looks like ordinary ETL.INTERNAL_STAGE_NETWORK_ACCESS_HISTORYrecords client IP andBYTES_OUTfor internal-stage access. UNC5537 usedCREATE TEMPORARY STAGE, and temporary stages are not kept inSTAGES. Business Critical Edition, AWS only, and opt-in viaSYSTEM$OPT_IN_INTERNAL_STAGE_NETWORK_LOGS.NETWORK_POLICIESrecordsALLOWED_IP_LISTandBLOCKED_IP_LISTafter a policy change. The statement text is inQUERY_HISTORY. The allow list is not a column on any source already in this issue.When completed, happy to start some OOTB prebuilt threat detection.
jamiehynds commentedon Sep 29, 2026
Thanks @terrancedejesus - looks like those 8 you've suggested are already included in our current scope, so we're aligned. Will keep you posted as we progress.
mohitjha-elastic commentedon Oct 7, 2026
This integration contains a total of 9 data streams, and the PRs will be raised in batches of 3 data streams each, as listed below. I’ll keep the progress updated here.
login_history,sessions,grants_to_users— [snowflake] Initial release with login_history, sessions, and grants_to_users Data Streams #21885access_history,data_transfer_history,stages- [snowflake] Initial release with access_history, data_transfer_history, and stages data streams #21995query_history,external_access_history,events- [snowflake] Add Support for query_history, events, and external_access_history Data Streams #22142mohitjha-elastic commentedon Oct 28, 2026
All PRs have been merged, and the changes should now be available. Closing the issue.
cc: @jamiehynds