{
  "Name": "Snowflake",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">",
  "Description": "The Snowflake CCF data connector provides the capability to ingest Snowflake [Login History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/login_history), [Query History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/query_history), [User-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users), [Role-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_roles), [Load History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/load_history), [Materialized View Refresh History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/materialized_view_refresh_history), [Roles Logs](https://docs.snowflake.com/en/sql-reference/account-usage/roles), [Tables Logs](https://docs.snowflake.com/en/sql-reference/account-usage/tables), [Table Storage Metrics Logs](https://docs.snowflake.com/en/sql-reference/account-usage/table_storage_metrics), [Users Logs](https://docs.snowflake.com/en/sql-reference/account-usage/users) into Microsoft Sentinel using the Snowflake SQL API. Refer to [Snowflake SQL API documentation](https://docs.snowflake.com/en/developer-guide/sql-api/reference) for more information. \n\n  **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n   • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)",
  "Analytic Rules": [
    "Analytic Rules/SnowflakeDiscoveryActivity.yaml",
    "Analytic Rules/SnowflakeLongQueryProcessTime.yaml",
    "Analytic Rules/SnowflakeMultipleFailedQueries.yaml",
    "Analytic Rules/SnowflakeMultipleLoginFailure.yaml",
    "Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml",
    "Analytic Rules/SnowflakePossibleDataDestruction.yaml",
    "Analytic Rules/SnowflakePrivilegesDiscovery.yaml",
    "Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml",
    "Analytic Rules/SnowflakeUnusualQuery.yaml",
    "Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/SnowflakeLogs_ccp/SnowflakeLogs_ConnectorDefinition.json"
  ],
  "Hunting Queries": [
    "Hunting Queries/SnowflakeAdminSources.yaml",
    "Hunting Queries/SnowflakeDeletedDatabases.yaml",
    "Hunting Queries/SnowflakeDeletedTables.yaml",
    "Hunting Queries/SnowflakeDormantUser.yaml",
    "Hunting Queries/SnowflakeFailedLogins.yaml",
    "Hunting Queries/SnowflakeHighCreditConsumingQueries.yaml",
    "Hunting Queries/SnowflakeTimeConsumingQueries.yaml",
    "Hunting Queries/SnowflakeUnknownQueryType.yaml",
    "Hunting Queries/SnowflakeUnusedAdmins.yaml",
    "Hunting Queries/SnowflakeUserSources.yaml"
  ],
  "Parsers": [
    "Parsers/Snowflake.yaml"
  ],
  "Workbooks": [
    "Workbooks/Snowflake.json"
  ],
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Snowflake",
  "Version": "3.1.0",
  "TemplateSpec": true,
  "Is1PConnector": false
}