Detection surface

What the platform exposes, what it hides, and where to build detection.

Detection coverage matrix — chain × maturity tier

The matrix below maps each attack chain to the rules that detect it, sliced by deployment-maturity tier. A row dense in Production-ready rules is a chain a SOC can cover on day one. A row whose only rules are sidecar-blocked is a chain where detection is gated on a separate engineering effort — the recommendations page names the policy-layer compensating control to use while the gate is being unlocked.

Rules that need work before they fire

The table below lists every rule whose default deployment posture is blocked until the customer wires up the dependency. A SOC that loads the rule pack without this work will not get alerts for the listed rules — and the silence will look like the rules are working, not like the dependency is missing.

For the 19 requires_enrichment rules, the dependency is a SIEM-side enrichment job rather than an external audit feed; the full derived-field contract is documented at detection/snowflake/ENRICHMENT.md and the templates ship under detection/snowflake/enrichment-templates/.

Primary audit sources

Blind spots

High-value detection queries

-- New external stages created in the last 24 hours
SELECT stage_name, stage_url, created
FROM SNOWFLAKE.ACCOUNT_USAGE.STAGES
WHERE stage_type = 'External'
  AND created > DATEADD(hour, -24, CURRENT_TIMESTAMP)
ORDER BY created DESC;

-- Logins without MFA (human users, last 7 days)
SELECT user_name, client_ip, login_time, first_authentication_factor
FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
WHERE login_time > DATEADD(day, -7, CURRENT_TIMESTAMP)
  AND first_authentication_factor = 'PASSWORD'
  AND second_factors IS NULL
ORDER BY login_time DESC;

-- COPY INTO external stage (potential bulk exfil)
SELECT user_name, query_text, start_time, bytes_written_to_result
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE start_time > DATEADD(day, -1, CURRENT_TIMESTAMP)
  AND (query_text ILIKE '%COPY INTO @%s3://%'
       OR query_text ILIKE '%COPY INTO @%azure://%')
ORDER BY bytes_written_to_result DESC;

-- New OWNER-rights stored procedures
SELECT procedure_name, procedure_language, created, execute_as
FROM SNOWFLAKE.ACCOUNT_USAGE.PROCEDURES
WHERE created > DATEADD(day, -7, CURRENT_TIMESTAMP)
  AND execute_as = 'OWNER';

-- Native App version changes
SELECT application_name, source_location, version, patch, created
FROM SNOWFLAKE.ACCOUNT_USAGE.APPLICATIONS
ORDER BY created DESC
LIMIT 50;

-- Long-lived or unused Programmatic Access Tokens
SELECT name, user_name, role_name, created_on, last_used_on, days_to_expiry
FROM SNOWFLAKE.ACCOUNT_USAGE.PROGRAMMATIC_ACCESS_TOKENS
WHERE (last_used_on IS NULL AND created_on < DATEADD(day, -30, CURRENT_TIMESTAMP))
   OR DATEDIFF(day, created_on, CURRENT_TIMESTAMP) > 90
ORDER BY created_on;

-- New or modified Direct Shares (Chain G — bypasses QUERY_HISTORY at data motion)
SELECT share_name, share_type, kind, created, last_altered, listing_global_name
FROM SNOWFLAKE.ACCOUNT_USAGE.SHARES
WHERE last_altered > DATEADD(day, -7, CURRENT_TIMESTAMP)
ORDER BY last_altered DESC;

-- DDL events for share / replication primitives (only catch at query time)
SELECT user_name, role_name, query_text, start_time
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE start_time > DATEADD(day, -7, CURRENT_TIMESTAMP)
  AND (query_text ILIKE 'CREATE%SHARE%'
       OR query_text ILIKE 'ALTER%SHARE%ADD%ACCOUNTS%'
       OR query_text ILIKE 'CREATE%REPLICATION%GROUP%'
       OR query_text ILIKE 'CREATE%MANAGED%ACCOUNT%')
ORDER BY start_time DESC;

Incident-response queries

Queries oriented toward containment and forensic enumeration after a credential or session has been flagged. These complement the proactive detection rules above.

-- Containment: kill a specific session (account admin only)
SELECT SYSTEM$ABORT_SESSION(<session_id>);

-- Containment: kill every running query for a flagged user
SELECT SYSTEM$CANCEL_ALL_QUERIES('<USER_NAME>');

-- Forensics: every session for a flagged user, last 14 days
SELECT session_id, login_event_id, client_application_id, client_ip, created_on
FROM SNOWFLAKE.ACCOUNT_USAGE.SESSIONS
WHERE user_name = '<USER_NAME>'
  AND created_on > DATEADD(day, -14, CURRENT_TIMESTAMP)
ORDER BY created_on DESC;

-- Forensics: every query in a flagged session
SELECT query_id, query_text, start_time, bytes_written_to_result, rows_produced
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE session_id = <SESSION_ID>
ORDER BY start_time;

-- Key-pair rotation age (Chain F target population)
SELECT name, has_rsa_public_key, has_rsa_public_key_2,
       rsa_public_key_fp, rsa_public_key_2_fp,
       last_success_login,
       DATEDIFF(day, created_on, CURRENT_TIMESTAMP) AS key_age_days
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS
WHERE has_rsa_public_key = 'true'
  AND deleted_on IS NULL
ORDER BY key_age_days DESC;

-- Service users without a network policy attached
SELECT u.name, u.type, u.has_rsa_public_key, u.last_success_login
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS u
LEFT JOIN SNOWFLAKE.ACCOUNT_USAGE.POLICY_REFERENCES p
  ON p.ref_entity_name = u.name AND p.policy_kind = 'NETWORK_POLICY'
WHERE u.deleted_on IS NULL
  AND (u.type = 'SERVICE' OR u.has_rsa_public_key = 'true')
  AND p.policy_id IS NULL;

-- OWNER-rights procedures (Snowflake-native persistence candidates)
SELECT procedure_name, procedure_owner, procedure_language, execute_as, created, last_altered
FROM SNOWFLAKE.ACCOUNT_USAGE.PROCEDURES
WHERE execute_as = 'OWNER'
  AND deleted IS NULL
ORDER BY last_altered DESC;

-- Scheduled Tasks and their owners (persistence audit)
SELECT name, database_name, schema_name, owner, owner_role_type,
       definition, schedule, state, last_altered
FROM SNOWFLAKE.ACCOUNT_USAGE.TASKS
WHERE deleted IS NULL
  AND state = 'started'
ORDER BY last_altered DESC;

-- Audit replication health (cross-region forensics depends on this)
SHOW REPLICATION DATABASES;
SELECT database_name, is_primary, replication_schedule, last_refresh_status_modified_at
FROM TABLE(INFORMATION_SCHEMA.DATABASE_REPLICATION_USAGE_HISTORY(
  DATE_RANGE_START => DATEADD(day, -7, CURRENT_DATE)));

-- Partner-integration users without a network policy (Chain J target)
-- These are the highest-priority remediation: a stolen credential from
-- a compromised partner SaaS replays from anywhere if no policy is bound.
SELECT u.name, u.type, u.has_rsa_public_key,
       u.last_success_login, tr.tag_value AS partner_id
FROM SNOWFLAKE.ACCOUNT_USAGE.USERS u
JOIN SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES tr
  ON tr.object_name = u.name AND tr.tag_name = 'PARTNER_ID'
LEFT JOIN SNOWFLAKE.ACCOUNT_USAGE.POLICY_REFERENCES p
  ON p.ref_entity_name = u.name AND p.policy_kind = 'NETWORK_POLICY'
WHERE u.deleted_on IS NULL
  AND p.policy_id IS NULL;

-- Iceberg external tables with metadata outside the documented catalog
-- base (Chain K — Polaris / Iceberg catalog abuse). Replace
-- 's3://lab-iceberg-warehouse/' with the customer's approved base.
SELECT table_catalog, table_schema, table_name,
       iceberg_metadata_file_path, table_storage_location, last_altered
FROM SNOWFLAKE.ACCOUNT_USAGE.TABLES
WHERE is_iceberg = 'YES'
  AND NOT (iceberg_metadata_file_path LIKE 's3://lab-iceberg-warehouse/%'
           OR table_storage_location LIKE 's3://lab-iceberg-warehouse/%')
ORDER BY last_altered DESC;

-- External OAuth integrations mapping to admin-class roles (Chain L)
-- Join against IdP-side consent export at ingest to detect silent
-- IdP-only scope widening.
SELECT integration_name, integration_type, created, last_altered,
       integration_parameters
FROM SNOWFLAKE.ACCOUNT_USAGE.INTEGRATIONS
WHERE integration_type = 'EXTERNAL_OAUTH'
  AND integration_parameters:DEFAULT_ROLE::STRING IN
      ('ACCOUNTADMIN', 'SECURITYADMIN', 'USERADMIN')
  AND deleted IS NULL;

-- UDFs declared with EAI callable by PUBLIC (Chain M) — egress is
-- attributed to the function owner; any invoker can trigger it.
SELECT f.function_owner, f.function_name, f.function_signature,
       f.external_access_integrations, f.privileged_users
FROM SNOWFLAKE.ACCOUNT_USAGE.FUNCTIONS f
WHERE f.external_access_integrations IS NOT NULL
  AND f.privileged_users ILIKE '%PUBLIC%'
  AND f.deleted IS NULL;

-- SPCS services with tag-pinned or off-registry images (Chain H
-- supply-chain extension). Replace 'internal.harbor.corp' with the
-- customer's approved-registry prefix list.
SELECT service_name, service_specification, last_updated_on
FROM SNOWFLAKE.ACCOUNT_USAGE.SERVICES
WHERE service_specification NOT LIKE '%@sha256:%'
   OR NOT service_specification LIKE '%internal.harbor.corp/%';