{ "name": "snowflake", "title": "Snowflake", "version": "0.2.0", "release": "beta", "source": { "license": "Elastic-2.0" }, "description": "Collect security telemetry from Snowflake ACCOUNT_USAGE views using the SQL API.", "type": "integration", "download": "/epr/snowflake/snowflake-0.2.0.zip", "path": "/package/snowflake/0.2.0", "icons": [ { "src": "/img/Snowflake_Logo.svg", "path": "/package/snowflake/0.2.0/img/Snowflake_Logo.svg", "title": "Snowflake logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.0 || ^9.1.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "cloud", "datastore" ], "signature_path": "/epr/snowflake/snowflake-0.2.0.zip.sig", "format_version": "3.4.2", "readme": "/package/snowflake/0.2.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/snowflake-authentication-and-access-overview.png", "path": "/package/snowflake/0.2.0/img/snowflake-authentication-and-access-overview.png", "title": "Authentication and Access Overview Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/snowflake/0.2.0/LICENSE.txt", "/package/snowflake/0.2.0/changelog.yml", "/package/snowflake/0.2.0/manifest.yml", "/package/snowflake/0.2.0/docs/README.md", "/package/snowflake/0.2.0/img/Snowflake_Logo.svg", "/package/snowflake/0.2.0/img/snowflake-authentication-and-access-overview.png", "/package/snowflake/0.2.0/kibana/tags.yml", "/package/snowflake/0.2.0/data_stream/access_history/manifest.yml", "/package/snowflake/0.2.0/data_stream/access_history/sample_event.json", "/package/snowflake/0.2.0/data_stream/data_transfer_history/manifest.yml", "/package/snowflake/0.2.0/data_stream/data_transfer_history/sample_event.json", "/package/snowflake/0.2.0/data_stream/grants_to_users/manifest.yml", "/package/snowflake/0.2.0/data_stream/grants_to_users/sample_event.json", "/package/snowflake/0.2.0/data_stream/login_history/manifest.yml", "/package/snowflake/0.2.0/data_stream/login_history/sample_event.json", "/package/snowflake/0.2.0/data_stream/sessions/manifest.yml", "/package/snowflake/0.2.0/data_stream/sessions/sample_event.json", "/package/snowflake/0.2.0/data_stream/stages/manifest.yml", "/package/snowflake/0.2.0/data_stream/stages/sample_event.json", "/package/snowflake/0.2.0/kibana/dashboard/snowflake-a721edd7-4792-4460-b4a1-fe27c8394838.json", "/package/snowflake/0.2.0/data_stream/access_history/fields/base-fields.yml", "/package/snowflake/0.2.0/data_stream/access_history/fields/beats.yml", "/package/snowflake/0.2.0/data_stream/access_history/fields/ecs.yml", "/package/snowflake/0.2.0/data_stream/access_history/fields/fields.yml", "/package/snowflake/0.2.0/data_stream/data_transfer_history/fields/base-fields.yml", "/package/snowflake/0.2.0/data_stream/data_transfer_history/fields/beats.yml", "/package/snowflake/0.2.0/data_stream/data_transfer_history/fields/ecs.yml", "/package/snowflake/0.2.0/data_stream/data_transfer_history/fields/fields.yml", "/package/snowflake/0.2.0/data_stream/grants_to_users/fields/base-fields.yml", "/package/snowflake/0.2.0/data_stream/grants_to_users/fields/beats.yml", "/package/snowflake/0.2.0/data_stream/grants_to_users/fields/ecs.yml", "/package/snowflake/0.2.0/data_stream/grants_to_users/fields/fields.yml", "/package/snowflake/0.2.0/data_stream/login_history/fields/base-fields.yml", "/package/snowflake/0.2.0/data_stream/login_history/fields/beats.yml", "/package/snowflake/0.2.0/data_stream/login_history/fields/ecs.yml", "/package/snowflake/0.2.0/data_stream/login_history/fields/fields.yml", "/package/snowflake/0.2.0/data_stream/sessions/fields/base-fields.yml", "/package/snowflake/0.2.0/data_stream/sessions/fields/beats.yml", "/package/snowflake/0.2.0/data_stream/sessions/fields/ecs.yml", "/package/snowflake/0.2.0/data_stream/sessions/fields/fields.yml", "/package/snowflake/0.2.0/data_stream/stages/fields/base-fields.yml", "/package/snowflake/0.2.0/data_stream/stages/fields/beats.yml", "/package/snowflake/0.2.0/data_stream/stages/fields/ecs.yml", "/package/snowflake/0.2.0/data_stream/stages/fields/fields.yml", "/package/snowflake/0.2.0/data_stream/access_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.2.0/data_stream/access_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.2.0/data_stream/data_transfer_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.2.0/data_stream/data_transfer_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.2.0/data_stream/grants_to_users/agent/stream/cel.yml.hbs", "/package/snowflake/0.2.0/data_stream/grants_to_users/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.2.0/data_stream/login_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.2.0/data_stream/login_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.2.0/data_stream/sessions/agent/stream/cel.yml.hbs", "/package/snowflake/0.2.0/data_stream/sessions/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.2.0/data_stream/stages/agent/stream/cel.yml.hbs", "/package/snowflake/0.2.0/data_stream/stages/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "snowflake", "title": "Snowflake logs", "description": "Collect Snowflake ACCOUNT_USAGE logs via the SQL API.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "Account URL", "description": "Snowflake account URL including scheme, for example `https://myorg-myaccount.snowflakecomputing.com`. PrivateLink hosts (`*.privatelink.snowflakecomputing.com`) are valid.", "multi": false, "required": true, "show_user": true }, { "name": "role", "type": "text", "title": "Role", "description": "Role passed in the SQL API request body. Must be granted to the user and hold the ACCOUNT_USAGE database roles plus warehouse USAGE.", "multi": false, "required": true, "show_user": true }, { "name": "warehouse", "type": "text", "title": "Warehouse", "description": "Virtual warehouse passed in the SQL API request body. Each poll consumes credits on this warehouse.", "multi": false, "required": true, "show_user": true }, { "name": "token", "type": "password", "title": "Token", "description": "Programmatic access token for the service user. Key-pair JWT is not supported.", "multi": false, "required": true, "show_user": true }, { "name": "ssl", "type": "yaml", "title": "SSL", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:", "multi": false, "required": false, "show_user": false } ], "title": "Collect Snowflake logs via SQL API", "description": "Collect Snowflake access history, data transfer history, stages, login history, sessions, and grants using the SQL API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "snowflake.access_history", "title": "Access History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query ACCESS_HISTORY. The view can lag by up to 3 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that ACCESS_HISTORY can lag by up to 180 minutes (3 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [ACCESS_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/access_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each ACCESS_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-access_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake access history", "description": "Collect object and column access events from SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY via the SQL API. Requires Snowflake Enterprise Edition or later.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "access_history" }, { "type": "logs", "dataset": "snowflake.data_transfer_history", "title": "Data Transfer History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query DATA_TRANSFER_HISTORY. Rows are aggregated into hourly windows and the view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that DATA_TRANSFER_HISTORY can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored START_TIME watermark so hourly windows that reach the view late are included. Actual latency can be less. See Snowflake [DATA_TRANSFER_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/data_transfer_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each DATA_TRANSFER_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-data_transfer_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake data transfer history", "description": "Collect hourly aggregated cross-cloud and cross-region data transfer volumes from SNOWFLAKE.ACCOUNT_USAGE.DATA_TRANSFER_HISTORY via the SQL API. Requires the USAGE_VIEWER database role (or equivalent) on the SNOWFLAKE database.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "data_transfer_history" }, { "type": "logs", "dataset": "snowflake.grants_to_users", "title": "Grants to Users", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query GRANTS_TO_USERS. The view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that GRANTS_TO_USERS can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [GRANTS_TO_USERS usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each GRANTS_TO_USERS statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-grants_to_users" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake grants to users", "description": "Collect role grants and revokes from SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "path": "grants_to_users" }, { "type": "logs", "dataset": "snowflake.login_history", "title": "Login History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query LOGIN_HISTORY. The view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that LOGIN_HISTORY can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [LOGIN_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/login_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each LOGIN_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-login_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake login history", "description": "Collect login attempts from SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "login_history" }, { "type": "logs", "dataset": "snowflake.sessions", "title": "Sessions", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query SESSIONS. The view can lag by up to 3 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that SESSIONS can lag by up to 180 minutes (3 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [SESSIONS usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/sessions). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each SESSIONS statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-sessions" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake sessions", "description": "Collect session lifecycle from SNOWFLAKE.ACCOUNT_USAGE.SESSIONS via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "sessions" }, { "type": "logs", "dataset": "snowflake.stages", "title": "Stages", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query STAGES. The view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Only stages created, altered, or dropped within this window are collected; older unchanged stages are not backfilled. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that STAGES can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark (the greatest LAST_ALTERED or DELETED seen) so rows that reach the view late are included. Actual latency can be less. See Snowflake [STAGES usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/stages). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each STAGES statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-stages" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake stages", "description": "Collect stage inventory changes (created, altered, and dropped stages) from SNOWFLAKE.ACCOUNT_USAGE.STAGES via the SQL API. Requires the OBJECT_VIEWER database role (or equivalent) on the SNOWFLAKE database.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "stages" } ] }