Snowflake external access occurred
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when an external access event occurs in your Snowflake environment.
Strategy
This rule allows you to detect when a new external access event occurs in Snowflake. Review any suspicious entries of external access performed by procedure or user-defined function (UDF) handler code within the last 365 days through the External Access History table. Unexpected use of external access for your environment is a potential indicator of compromise.
Triage and response
- Inspect the logs to identify the source cloud, source region, target cloud, target region, and query ID.
- Investigate whether the source and target cloud locations are expected.
- Using the query ID, correlate the behavior with Query History logs to determine the user, query, and other useful information.
- If there are signs of compromise, disable the user associated with the external access integration and rotate credentials.
