Snowflake - Multiple failed queries

Back


Id	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
Rulename	Snowflake - Multiple failed queries
Description	Detects multiple failed queries in short timeframe.
Severity	High
Tactics	Discovery
Techniques	T1518 T1082
Required data connectors	Snowflake
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
Version	1.0.1
Arm template	5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8.json

KQL

let threshold = 50;
Snowflake
| where EXECUTION_STATUS_s !~ 'SUCCESS'
| summarize count() by TargetUsername, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = TargetUsername

YAML

name: Snowflake - Multiple failed queries
status: Available
triggerThreshold: 0
severity: High
tactics:
- Discovery
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
queryPeriod: 1h
queryFrequency: 1h
version: 1.0.1
triggerOperator: gt
description: |
    'Detects multiple failed queries in short timeframe.'
query: |
  let threshold = 50;
  Snowflake
  | where EXECUTION_STATUS_s !~ 'SUCCESS'
  | summarize count() by TargetUsername, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend AccountCustomEntity = TargetUsername  
relevantTechniques:
- T1518
- T1082
id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8
requiredDataConnectors:
- dataTypes:
  - Snowflake
  connectorId: Snowflake
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]",
      "properties": {
        "alertRuleTemplateName": "5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8",
        "customDetails": null,
        "description": "'Detects multiple failed queries in short timeframe.'\n",
        "displayName": "Snowflake - Multiple failed queries",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml",
        "query": "let threshold = 50;\nSnowflake\n| where EXECUTION_STATUS_s !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1082",
          "T1518"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}