Snowflake - Multiple failed queries

Back


Id	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
Rulename	Snowflake - Multiple failed queries
Description	Detects multiple failed queries in short timeframe.
Severity	High
Tactics	Discovery
Techniques	T1518 T1082
Required data connectors	Snowflake
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
Version	1.0.3
Arm template	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8.json

KQL

let threshold = 50;
Snowflake
| where isnotempty(QueryExecutionStatus)
| where QueryExecutionStatus !~ 'SUCCESS'
| summarize count() by TargetUsername, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = TargetUsername

YAML

name: Snowflake - Multiple failed queries
relevantTechniques:
- T1518
- T1082
id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
requiredDataConnectors:
- dataTypes:
  - Snowflake
  connectorId: Snowflake
version: 1.0.3
severity: High
triggerThreshold: 0
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
queryFrequency: 1h
status: Available
query: |
  let threshold = 50;
  Snowflake
  | where isnotempty(QueryExecutionStatus)
  | where QueryExecutionStatus !~ 'SUCCESS'
  | summarize count() by TargetUsername, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend AccountCustomEntity = TargetUsername  
tactics:
- Discovery
kind: Scheduled
description: |
    'Detects multiple failed queries in short timeframe.'
triggerOperator: gt

ARM