Snowflake - Multiple failed queries

Back


Id	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
Rulename	Snowflake - Multiple failed queries
Description	Detects multiple failed queries in short timeframe.
Severity	High
Tactics	Discovery
Techniques	T1518 T1082
Required data connectors	Snowflake
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
Version	1.0.2
Arm template	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8.json

KQL

let threshold = 50;
Snowflake
| where QueryExecutionStatus !~ 'SUCCESS'
| summarize count() by TargetUsername, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = TargetUsername

YAML

description: |
    'Detects multiple failed queries in short timeframe.'
kind: Scheduled
tactics:
- Discovery
requiredDataConnectors:
- connectorId: Snowflake
  dataTypes:
  - Snowflake
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
severity: High
name: Snowflake - Multiple failed queries
triggerThreshold: 0
queryPeriod: 1h
query: |
  let threshold = 50;
  Snowflake
  | where QueryExecutionStatus !~ 'SUCCESS'
  | summarize count() by TargetUsername, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend AccountCustomEntity = TargetUsername  
relevantTechniques:
- T1518
- T1082
id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name

ARM