[mohitjha-elastic]

Proposed commit message

snowflake: add support for login_history, sessions, and grants_to_users data stream.

This release includes login_history, sessions, and grants_to_users data stream, 
associated dashboard and visualizations.
The fields are mapped to their corresponding ECS fields where possible.
Field Schemas and Test samples were derived from live data samples and documentation[1], which were 
subsequently sanitized.

[1] https://docs.snowflake.com/en/sql-reference/snowflake-db

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the integration:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/snowflake directory.
• Run the following command to run tests.

elastic-package test -v

Screenshots

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 2 warnings, 7 suggestions found

⚠️ Warnings (2): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/snowflake/_dev/build/docs/README.md	75	Elastic.MenuArrowsBold	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/snowflake/_dev/build/docs/README.md	75	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.

💡 Suggestions (7): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/snowflake/_dev/build/docs/README.md	86	Elastic.Semicolons	Use semicolons sparingly. Consider splitting the sentence or using a comma or conjunction.
packages/snowflake/_dev/build/docs/README.md	91	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/snowflake/_dev/build/docs/README.md	145	Elastic.Semicolons	Use semicolons sparingly. Consider splitting the sentence or using a comma or conjunction.
packages/snowflake/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/snowflake/data_stream/grants_to_users/manifest.yml	31	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/snowflake/data_stream/login_history/manifest.yml	31	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/snowflake/data_stream/sessions/manifest.yml	31	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[mohitjha-elastic]

@vera-review-bot review

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[ShourieG]

Some existing issues -

[vera-review-bot]

Severity: 🔵 Low confidence: medium path: packages/snowflake/kibana/dashboard/snowflake-a721edd7-4792-4460-b4a1-fe27c8394838.json:1097

The heatmap's hour and weekday buckets come from ES|QL DATE_EXTRACT/DATE_FORMAT, which evaluate in UTC, but the axes are titled just "Hour" and "Day of week". Label them as UTC so users in other time zones don't read the pattern as local time.

Details

The rewritten 'Login Activity by Week and Hour' panel (lines 1097/1107) derives day_of_week with DATE_FORMAT("e"/"EEE", @​timestamp) and hour_of_day with DATE_EXTRACT("hour_of_day", @​timestamp). It follows maintainer thread 4258386344 and fixes the earlier diagonal date-histogram heatmap. The query passes no time zone, so ES|QL buckets in UTC. Lens date-histogram panels on the same dashboard, such as 'Login Attempts over Time', follow the browser or dateFormat:tz zone. For a user outside UTC, this heatmap puts logins in a different hour than the rest of the dashboard, and near midnight in a different weekday. The axis titles at line 1118-1119 (xTitle: "Day of week", yTitle: "Hour") do not mention this. Impact is presentational only.

Recommendation:

Make the UTC basis explicit. For example, set the heatmap xTitle/yTitle (lines 1118-1119) and the column labels (lines 1067/1077) to "Day of week (UTC)" and "Hour (UTC)", or rename the panel to "Login Activity by Week and Hour (UTC)".

---

🤖 AI-Generated Review | Vera Review Bot - v0.4.3 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[kcreddy]

@mohitjha-elastic can you check #21995 review comments and apply here as applicable especially Dan's.

[vera-review-bot]

🟢 No issues across the latest commits 9cb69f0.

⚠️ 1 comment still unresolved from earlier commits — 1 low

• 🔵 The heatmap's hour and weekday buckets come from ES|QL DATE_EXTRACT/DATE_FORMAT, which evaluate in UTC, but the axes are titled just "Hour" and "Day of week". Label them as UTC so users in other time zones don't read the pattern as local time. (link)

Review summary

Issues found across earlier commits 6f0502e — 1 medium, 1 low

• 🟡 The new page_timestamp null guard does not cover the keyset fields next to it. When the last row of a page has a null GRANTEE_NAME or ROLE, string(null) fails and grants_to_users stops collecting. Guard last_grantee_name and last_role against null the same way. (link)
• 🔵 A 429 on a GET status poll is now handled like a 202, but no mock rule returns 429, so no system test runs this branch. Add a GET rule that returns enough 429 QueryStatus responses to exhaust client retries, followed by a 200. (link)

Issues found across earlier commits d028bd3 — 1 low

• 🔵 The heatmap's hour and weekday buckets come from ES|QL DATE_EXTRACT/DATE_FORMAT, which evaluate in UTC, but the axes are titled just "Hour" and "Day of week". Label them as UTC so users in other time zones don't read the pattern as local time. (link)

Issues found across earlier commits 158627f (history rewritten since 74f36db) — 1 low

• 🔵 The grants_to_users continuation test never returns a full LIMIT page on the deleted pass, so the deleted keyset continuation goes untested. Make one deleted response a full page and add a matching deleted-keyset mock rule. (link)

Issues found across earlier commits 74f36db — 1 high

• 🟠 In grants_to_users, an empty, non-continuation deleted pass emits no events, so the CEL input never adopts the reset cursor (query: created). Collection then sticks on the deleted query, and the new continuation test cannot catch it. Publish the retry placeholder for every empty page. (link)

Issues found across earlier commits d6a9ff1 — 1 medium

• 🟡 No system test reaches the new LIMIT keyset-continuation path (continue/page_timestamp, empty-continuation placeholder), because every config uses batch_size 10000 and no mock returns more than 5 rows. Add a small-batch_size system test with a mock rule for the continuation statement. (link)

Earlier reviews fd579ea … f7c5b51 — 4 reviews, 11 findings

Issues found across earlier commits f7c5b51 — 2 medium

• 🟡 An empty LIMIT continuation emits dyn([]), so the CEL input never adopts the reset cursor and continue: true sticks. In grants_to_users this also leaves query: deleted set, which blocks the created pass. Emit the retry placeholder whenever the previous cursor was a continuation. (link) (Outdated)
• 🟡 The continuation binds the max watermark, which still includes the earlier cursor value, together with the last row's EVENT_ID. When a full first page lies entirely inside the lag window, the rest of that window is skipped. Key the continuation on the last row's own timestamp. (link)

Issues found across earlier commits 53f3e18 — 2 medium

• 🟡 A LIMIT-filled continuation re-queries with >= watermark and no tiebreak, so a full page whose rows all share the watermark timestamp is re-read identically until max_executions (link) (Outdated)
• 🟡 login_history and sessions still nest six .as() bindings (http_method, request_url, resp, body, result, row_timestamps), above the five-level cap (link) (Outdated)

Issues found across earlier commits 9786d39 — 1 high, 1 medium

• 🟠 Continuation statements re-subtract lag_time from the watermark, so when batch_size or more rows fall inside one lag window the same page is re-read until max_executions and newer rows are never reached (link) (Outdated)
• 🟡 grants_to_users nests seven .as() bindings (query, http_method, request_url, resp, body, result, row_timestamps), above the five-level guideline (link) (Outdated)

Issues found across earlier commits fd579ea — 1 high, 3 medium, 1 low

• 🟡 login_history and sessions issue one LIMIT-sized statement per interval, so a backlog larger than batch_size is never caught up within a cycle (link) (Outdated)
• 🟡 The in-progress (202) branch re-evaluates immediately with want_more: true, busy-polling the statement status endpoint while Snowflake is still executing (link) (Outdated)
• 🟡 Pipeline fixtures only cover well-formed rows (link)
• 🔵 grants_to_users detects a full LIMIT page with the per-partition row count, which is smaller than batch_size whenever Snowflake splits the result into partitions (link) (Outdated)

Package-level:

• 🟠 Missing _dev/test/pipeline/test-common-config.yml in all three data streams

  Add the same file to each of the three pipeline test directories:

  fields:
    tags:
      - preserve_original_event

  Then regenerate the expected outputs with elastic-package test pipeline --generate.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.4.3 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[kcreddy]

LGTM (after merge conflicts)

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: ec76661

History

• 💚 Build #51820 succeeded 9cb69f0
• 💚 Build #51817 succeeded 6f0502e
• 💚 Build #51650 succeeded d028bd3
• 💚 Build #51506 succeeded 158627f
• 💚 Build #51485 succeeded d6a9ff1
• 💚 Build #51469 succeeded f7c5b51

cc @mohitjha-elastic

[mohitjha-elastic]

As Shourie is currently out, and his review comments have been addressed, we’re proceeding with merging the PR. @ShourieG Please let us know if you have any concerns regarding the review comments; we can address them in a follow-up PR.

[elastic-vault-github-plugin-prod]

Package snowflake - 0.2.0 containing this change is available at https://epr.elastic.co/package/snowflake/0.2.0/