Snowflake - Multiple failed queries

Back


Id	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
Rulename	Snowflake - Multiple failed queries
Description	Detects multiple failed queries in short timeframe.
Severity	High
Tactics	Discovery
Techniques	T1518 T1082
Required data connectors	Snowflake
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
Version	1.0.1
Arm template	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8.json

KQL

let threshold = 50;
Snowflake
| where EXECUTION_STATUS_s !~ 'SUCCESS'
| summarize count() by TargetUsername, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = TargetUsername

YAML

relevantTechniques:
- T1518
- T1082
name: Snowflake - Multiple failed queries
requiredDataConnectors:
- dataTypes:
  - Snowflake
  connectorId: Snowflake
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
triggerThreshold: 0
id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
tactics:
- Discovery
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: High
status: Available
description: |
    'Detects multiple failed queries in short timeframe.'
query: |
  let threshold = 50;
  Snowflake
  | where EXECUTION_STATUS_s !~ 'SUCCESS'
  | summarize count() by TargetUsername, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend AccountCustomEntity = TargetUsername  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]",
      "properties": {
        "alertRuleTemplateName": "5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8",
        "customDetails": null,
        "description": "'Detects multiple failed queries in short timeframe.'\n",
        "displayName": "Snowflake - Multiple failed queries",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml",
        "query": "let threshold = 50;\nSnowflake\n| where EXECUTION_STATUS_s !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1082",
          "T1518"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}