Log Sources for Security Monitoring

Customers can monitor their Snowflake deployment for potential indicators of compromise by integrating Snowflake log sources with their Security Information and Event Monitoring (SIEM) solution. This guide documents the security identifiers and the Information Schema and Account Usage columns that Snowflake recommends customers monitor. In addition, this publication maps columns to the MITRE ATT&CK SaaS Matrix, an industry framework that helps security analysts implement detection and response controls that align to their organization's incident response procedures.

Security Identifiers and Views

Security Identifier/View	Columns	Schema Location	Latency	MITRE ATT&CK
`APPLICABLE_ROLES`	`GRANTEE` `ROLE_NAME` `ROLE_OWNER` `IS_GRANTABLE`	`INFORMATION_SCHEMA`	n/a	T1060- Permission Group Discovery T1087 - Account Discovery
`STAGES`	`STAGE_NAME` `CREATED` `LAST_ALTERED`	`INFORMATION_SCHEMA`	n/a	T1213- Data Collection/ Exfiltration T1074 Data Staged
`USAGE_PRIVILEGES`	`GRANTOR` `GRANTEE` `PRIVILEGE_TYPE` `IS_GRANTABLE` `CREATED`	`INFORMATION_SCHEMA`	n/a	T1078- Privilege Escalation
`OBJECT_PRIVILEGES`	`GRANTOR` `GRANTEE` `PRIVILEGE_TYPE` `IS_GRANTABLE` `CREATED`	`INFORMATION_SCHEMA`	n/a	T1078- Privilege Escalation
`ACCESS_HISTORY`	`QUERY_ID` `QUERY_START_TIME` `USER_NAME` `DIRECT_OBJECTS_ACCESSED` `BASE_OBJECTS_ACCESSSED`	`ACCOUNT_USAGE`	3 hours	T1078- Valid Accounts
`COPY_HISTORY`	All Applicable Columns	`ACCOUNT_USAGE`	2 Hours	T1213- Data Collection T1074 - Data Staged
`DATA_TRANSFER_HISTORY`	`START_TIME` `END_TIME` `SOURCE_CLOUD` `SOURCE_REGION` `TARGET_CLOUD` `TARGET_REGION`	`ACCOUNT_USAGE`	2 Hours	T1213- Data Collection T1074 - Data Staged
`GRANTS_TO_ROLES`	`CREATED_ON` `MODIFIED_ON` `PRIVILEGE` `GRANTED_ON` `NAME` `GRANTED_TO` `GRANTEE_NAME` `GRANT_OPTION` `GRANTED_BY` `DELETED_ON`	`ACCOUNT_USAGE`	2 Hours	T1078- Privilege Escalation
`GRANTS_TO_USERS`	`CREATED_ON` `DELETED_ON` `ROLE` `GRANTED_TO` `GRANTEE_NAME` `GRANTED_BY`	`ACCOUNT_USAGE`	2 hours	T1078- Privilege Escalation
`LOGIN_HISTORY`	`EVENT_TIMESTAMP` `EVENT_TYPE` `USER_NAME` `CLIENT_IP` `REPORTED_CLIENT_TYPE` `FIRST_AUTHENTICATION_FACTOR` `SECOND_AUTHENTICATION_FACTOR` `IS_SUCCESS`	`ACCOUNT_USAGE`	2 hours	T1078.004- Cloud Accounts
`MASKING_POLICIES`	`POLICY_NAME` `CREATED` `LAST_ALTERED` `DELETED`	`ACCOUNT_USAGE`	2 hours	T1080- Taint Shared Content TA0005 - Defense Evasion
`QUERY_HISTORY`	All Applicable Columns	`ACCOUNT_USAGE`	45 minutes	TA0003 - Persistence TA0003 - Valid Accounts
`ROLES`	`CREATED_ON` `DELETED_ON` `NAME`	`ACCOUNT_USAGE`	2 hours	TA0003 - Persistence
`ROW_ACCESS_POLICIES`	`POLICY_NAME` `CREATED` `LAST_ALTERED` `DELETED`	`ACCOUNT_USAGE`	2 hours	T1080- Taint Shared Content TA0005 - Defense Evasion
`SESSIONS`	`SESSION_ID` `CREATED_ON` `USER_NAME` `AUTHENTICATION_METHOD` `LOGIN_EVENT_ID` `CLIENT_APPLICATION_VERSION` `CLIENT_APPLICATION_ID` `CLIENT_ENVIORNMENT` `CLIENT_BUILD_ID` `CLIENT_VERSION`	`ACCOUNT_USAGE`	3 hours	TA0003 - Persistence T1550 - Use Alternate Authentication Material
`STAGES`	`STAGE_NAME` `CREATED` `LAST_ALTERED` `DELETED`	`ACCOUNT_USAGE`	2 hours	T1074 - Data Staged
`USERS`	All Applicable Columns	`ACCOUNT_USAGE`	2 hours	TA0003 - Persistence TA0003 - Valid Accounts
`DATABASES`	`DATABASE_NAME` `CREATED` `LAST_ALTERED` `DELETED`	`ACCOUNT_USAGE`	2 hours	T1074 - Data Staged
`TABLES`	`TABLE_OWNER` `CREATED` `LAST_ALTERED` `DELETED`	`ACCOUNT_USAGE`	2 hours	T1074 - Data Staged

Sentry documentation

Log Sources for Security Monitoring

Security Identifiers and Views