{ "name": "snowflake", "title": "Snowflake", "version": "0.3.0", "release": "beta", "source": { "license": "Elastic-2.0" }, "description": "Collect security telemetry from Snowflake ACCOUNT_USAGE views and event tables using the SQL API.", "type": "integration", "download": "/epr/snowflake/snowflake-0.3.0.zip", "path": "/package/snowflake/0.3.0", "icons": [ { "src": "/img/Snowflake_Logo.svg", "path": "/package/snowflake/0.3.0/img/Snowflake_Logo.svg", "title": "Snowflake logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^9.4.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "cloud", "datastore" ], "signature_path": "/epr/snowflake/snowflake-0.3.0.zip.sig", "format_version": "3.4.2", "readme": "/package/snowflake/0.3.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/snowflake-authentication-and-access-overview.png", "path": "/package/snowflake/0.3.0/img/snowflake-authentication-and-access-overview.png", "title": "Authentication and Access Overview Dashboard", "size": "1920x1866", "type": "image/png" }, { "src": "/img/snowflake-query-analysis-and-security.png", "path": "/package/snowflake/0.3.0/img/snowflake-query-analysis-and-security.png", "title": "Query Analysis and Security Dashboard", "size": "1920x1691", "type": "image/png" }, { "src": "/img/snowflake-user-activity.png", "path": "/package/snowflake/0.3.0/img/snowflake-user-activity.png", "title": "User Activity Dashboard", "size": "1920x2216", "type": "image/png" }, { "src": "/img/snowflake-data-access-patterns.png", "path": "/package/snowflake/0.3.0/img/snowflake-data-access-patterns.png", "title": "Data Access Patterns Dashboard", "size": "1920x2216", "type": "image/png" }, { "src": "/img/snowflake-handler-event-logs.png", "path": "/package/snowflake/0.3.0/img/snowflake-handler-event-logs.png", "title": "Handler Event Logs Dashboard", "size": "1920x1691", "type": "image/png" } ], "assets": [ "/package/snowflake/0.3.0/LICENSE.txt", "/package/snowflake/0.3.0/changelog.yml", "/package/snowflake/0.3.0/manifest.yml", "/package/snowflake/0.3.0/docs/README.md", "/package/snowflake/0.3.0/img/Snowflake_Logo.svg", "/package/snowflake/0.3.0/img/snowflake-authentication-and-access-overview.png", "/package/snowflake/0.3.0/img/snowflake-data-access-patterns.png", "/package/snowflake/0.3.0/img/snowflake-handler-event-logs.png", "/package/snowflake/0.3.0/img/snowflake-query-analysis-and-security.png", "/package/snowflake/0.3.0/img/snowflake-user-activity.png", "/package/snowflake/0.3.0/kibana/tags.yml", "/package/snowflake/0.3.0/data_stream/access_history/manifest.yml", "/package/snowflake/0.3.0/data_stream/access_history/sample_event.json", "/package/snowflake/0.3.0/data_stream/data_transfer_history/manifest.yml", "/package/snowflake/0.3.0/data_stream/data_transfer_history/sample_event.json", "/package/snowflake/0.3.0/data_stream/events/manifest.yml", "/package/snowflake/0.3.0/data_stream/events/sample_event.json", "/package/snowflake/0.3.0/data_stream/external_access_history/manifest.yml", "/package/snowflake/0.3.0/data_stream/external_access_history/sample_event.json", "/package/snowflake/0.3.0/data_stream/grants_to_users/manifest.yml", "/package/snowflake/0.3.0/data_stream/grants_to_users/sample_event.json", "/package/snowflake/0.3.0/data_stream/login_history/manifest.yml", "/package/snowflake/0.3.0/data_stream/login_history/sample_event.json", "/package/snowflake/0.3.0/data_stream/query_history/manifest.yml", "/package/snowflake/0.3.0/data_stream/query_history/sample_event.json", "/package/snowflake/0.3.0/data_stream/sessions/manifest.yml", "/package/snowflake/0.3.0/data_stream/sessions/sample_event.json", "/package/snowflake/0.3.0/data_stream/stages/manifest.yml", "/package/snowflake/0.3.0/data_stream/stages/sample_event.json", "/package/snowflake/0.3.0/kibana/dashboard/snowflake-4b99a8af-7fdb-430d-82bb-afd1a25479bd.json", "/package/snowflake/0.3.0/kibana/dashboard/snowflake-6462c3e6-8189-4f28-afb4-19120fe464eb.json", "/package/snowflake/0.3.0/kibana/dashboard/snowflake-a721edd7-4792-4460-b4a1-fe27c8394838.json", "/package/snowflake/0.3.0/kibana/dashboard/snowflake-a7e2b707-d5d5-4b1a-9204-71abff97e035.json", "/package/snowflake/0.3.0/kibana/dashboard/snowflake-fd63d15c-203c-4785-bcc8-5ee80b070134.json", "/package/snowflake/0.3.0/kibana/search/snowflake-1bcb2507-6a66-4929-940b-ca55e277ccae.json", "/package/snowflake/0.3.0/kibana/search/snowflake-37d8053b-f615-4cd0-85b8-53a0def440ef.json", "/package/snowflake/0.3.0/kibana/search/snowflake-4a191f01-6f92-49cd-b82a-aafba5b2de57.json", "/package/snowflake/0.3.0/kibana/search/snowflake-c86d2fd9-8bd0-48a3-9e72-a6251556a68b.json", "/package/snowflake/0.3.0/data_stream/access_history/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/access_history/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/access_history/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/access_history/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/data_transfer_history/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/data_transfer_history/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/data_transfer_history/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/data_transfer_history/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/events/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/events/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/events/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/events/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/external_access_history/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/external_access_history/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/external_access_history/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/external_access_history/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/grants_to_users/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/grants_to_users/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/grants_to_users/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/grants_to_users/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/login_history/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/login_history/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/login_history/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/login_history/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/query_history/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/query_history/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/query_history/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/query_history/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/sessions/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/sessions/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/sessions/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/sessions/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/stages/fields/base-fields.yml", "/package/snowflake/0.3.0/data_stream/stages/fields/beats.yml", "/package/snowflake/0.3.0/data_stream/stages/fields/ecs.yml", "/package/snowflake/0.3.0/data_stream/stages/fields/fields.yml", "/package/snowflake/0.3.0/data_stream/access_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/access_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/data_transfer_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/data_transfer_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/events/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/external_access_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/external_access_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/grants_to_users/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/grants_to_users/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/login_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/login_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/query_history/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/query_history/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/sessions/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/sessions/elasticsearch/ingest_pipeline/default.yml", "/package/snowflake/0.3.0/data_stream/stages/agent/stream/cel.yml.hbs", "/package/snowflake/0.3.0/data_stream/stages/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "snowflake", "title": "Snowflake logs", "description": "Collect Snowflake ACCOUNT_USAGE and event table logs via the SQL API.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "Account URL", "description": "Snowflake account URL including scheme, for example `https://myorg-myaccount.snowflakecomputing.com`. PrivateLink hosts (`*.privatelink.snowflakecomputing.com`) are valid.", "multi": false, "required": true, "show_user": true }, { "name": "role", "type": "text", "title": "Role", "description": "Role passed in the SQL API request body. Must be granted to the user and hold the ACCOUNT_USAGE database roles plus warehouse USAGE.", "multi": false, "required": true, "show_user": true }, { "name": "warehouse", "type": "text", "title": "Warehouse", "description": "Virtual warehouse passed in the SQL API request body. Each poll consumes credits on this warehouse.", "multi": false, "required": true, "show_user": true }, { "name": "token", "type": "password", "title": "Token", "description": "Programmatic access token for the service user. Key-pair JWT is not supported.", "multi": false, "required": true, "show_user": true }, { "name": "ssl", "type": "yaml", "title": "SSL", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:", "multi": false, "required": false, "show_user": false } ], "title": "Collect Snowflake logs via SQL API", "description": "Collect Snowflake access history, data transfer history, stages, login history, sessions, grants, query history, event table handler logs, and external access history using the SQL API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "snowflake.access_history", "title": "Access History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query ACCESS_HISTORY. The view can lag by up to 3 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that ACCESS_HISTORY can lag by up to 180 minutes (3 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [ACCESS_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/access_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each ACCESS_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-access_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake access history", "description": "Collect object and column access events from SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY via the SQL API. Requires Snowflake Enterprise Edition or later.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "access_history" }, { "type": "logs", "dataset": "snowflake.data_transfer_history", "title": "Data Transfer History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query DATA_TRANSFER_HISTORY. Rows are aggregated into hourly windows and the view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that DATA_TRANSFER_HISTORY can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored START_TIME watermark so hourly windows that reach the view late are included. Actual latency can be less. See Snowflake [DATA_TRANSFER_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/data_transfer_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each DATA_TRANSFER_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-data_transfer_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake data transfer history", "description": "Collect hourly aggregated cross-cloud and cross-region data transfer volumes from SNOWFLAKE.ACCOUNT_USAGE.DATA_TRANSFER_HISTORY via the SQL API. Requires the USAGE_VIEWER database role (or equivalent) on the SNOWFLAKE database.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "data_transfer_history" }, { "type": "logs", "dataset": "snowflake.events", "title": "Events", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "event_table", "type": "text", "title": "Event table", "description": "Fully qualified event table or view (1–3 part identifier). Default is SNOWFLAKE.TELEMETRY.EVENTS_VIEW, which SNOWFLAKE.EVENTS_VIEWER can read. Set this to a custom event table if you do not use the account view. Discover the account table with SHOW PARAMETERS LIKE 'EVENT_TABLE' IN ACCOUNT.", "multi": false, "required": true, "show_user": true, "default": "SNOWFLAKE.TELEMETRY.EVENTS_VIEW" }, { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query the event table. Telemetry is nearer real time than ACCOUNT_USAGE views; a 2 hour interval is a conservative starting point.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Overlap subtracted from the stored TIMESTAMP watermark after a short (caught-up) page so late-arriving telemetry rows are included. Lag is not applied while paging through a full LIMIT batch. Event tables have no published ACCOUNT_USAGE latency; 15m is the default overlap. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each event table statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-events" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake event table telemetry", "description": "Collect handler log messages (RECORD_TYPE LOG) from the Snowflake event table via the SQL API. SPAN, SPAN_EVENT, METRIC, and EVENT rows are dropped during ingest.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "path": "events" }, { "type": "logs", "dataset": "snowflake.external_access_history", "title": "External Access History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query EXTERNAL_ACCESS_HISTORY. The view can lag by up to 180 minutes (2–3 hours), so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that EXTERNAL_ACCESS_HISTORY can lag by up to 180 minutes, and the joined QUERY_HISTORY view can also be late. After a short (caught-up) page, the integration subtracts this duration from the stored QUERY_HISTORY.END_TIME watermark so late-arriving rows are included. Lag is not applied while paging through a full LIMIT batch. See Snowflake [EXTERNAL_ACCESS_HISTORY](https://docs.snowflake.com/en/sql-reference/account-usage/external_access_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each EXTERNAL_ACCESS_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-external_access_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake external access history", "description": "Collect outbound network access from SNOWFLAKE.ACCOUNT_USAGE.EXTERNAL_ACCESS_HISTORY, joined to QUERY_HISTORY for event time, via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "path": "external_access_history" }, { "type": "logs", "dataset": "snowflake.grants_to_users", "title": "Grants to Users", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query GRANTS_TO_USERS. The view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that GRANTS_TO_USERS can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [GRANTS_TO_USERS usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each GRANTS_TO_USERS statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-grants_to_users" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake grants to users", "description": "Collect role grants and revokes from SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "path": "grants_to_users" }, { "type": "logs", "dataset": "snowflake.login_history", "title": "Login History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query LOGIN_HISTORY. The view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that LOGIN_HISTORY can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [LOGIN_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/login_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each LOGIN_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-login_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake login history", "description": "Collect login attempts from SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "login_history" }, { "type": "logs", "dataset": "snowflake.query_history", "title": "Query History", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query QUERY_HISTORY. The view can lag by up to 45 minutes, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that QUERY_HISTORY can lag by up to 45 minutes. After a short (caught-up) page, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Lag is not applied while paging through a full LIMIT batch. Actual latency can be less. See Snowflake [QUERY_HISTORY usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/query_history). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "45m" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each QUERY_HISTORY statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-query_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake query history", "description": "Collect completed SQL statements from SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "path": "query_history" }, { "type": "logs", "dataset": "snowflake.sessions", "title": "Sessions", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query SESSIONS. The view can lag by up to 3 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that SESSIONS can lag by up to 180 minutes (3 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark so late-arriving rows in the view are included. Actual latency can be less. See Snowflake [SESSIONS usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/sessions). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each SESSIONS statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-sessions" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake sessions", "description": "Collect session lifecycle from SNOWFLAKE.ACCOUNT_USAGE.SESSIONS via the SQL API.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "sessions" }, { "type": "logs", "dataset": "snowflake.stages", "title": "Stages", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to query STAGES. The view can lag by up to 2 hours, so polling faster than that does not make data fresher.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "initial_interval", "type": "text", "title": "Initial interval", "description": "How far back to query on the first run when no cursor exists. Only stages created, altered, or dropped within this window are collected; older unchanged stages are not backfilled. Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "lag_time", "type": "text", "title": "Lag time", "description": "Snowflake documents that STAGES can lag by up to 120 minutes (2 hours). On each new SQL statement, the integration subtracts this duration from the stored watermark (the greatest LAST_ALTERED or DELETED seen) so rows that reach the view late are included. Actual latency can be less. See Snowflake [STAGES usage notes](https://docs.snowflake.com/en/sql-reference/account-usage/stages). Supported units are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch size", "description": "SQL LIMIT applied to each STAGES statement. Result partitions are still chosen by Snowflake.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "HTTP timeout for submit, poll, and partition requests. Snowflake statement execution limits follow account or warehouse STATEMENT_TIMEOUT_IN_SECONDS.", "multi": false, "required": false, "show_user": false, "default": "90s" }, { "name": "resource_retry_max_attempts", "type": "text", "title": "Resource Retry Max Attempts", "description": "Maximum number of retries for the HTTP client. Default is \"5\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_min", "type": "text", "title": "Resource Retry Wait Min", "description": "Minimum time to wait before a retry is attempted. Default is \"1s\".", "multi": false, "required": false, "show_user": false }, { "name": "resource_retry_wait_max", "type": "text", "title": "Resource Retry Wait Max", "description": "Maximum time to wait before a retry is attempted. Default is \"60s\".", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "snowflake-stages" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Snowflake stages", "description": "Collect stage inventory changes (created, altered, and dropped stages) from SNOWFLAKE.ACCOUNT_USAGE.STAGES via the SQL API. Requires the OBJECT_VIEWER database role (or equivalent) on the SNOWFLAKE database.", "enabled": true, "ingestion_method": "API" } ], "package": "snowflake", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "stages" } ] }