Snowflake (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | SnowflakeLogsCCPDefinition |
| Publisher | Microsoft |
| Used in Solutions | Snowflake |
| Collection Method | CCF |
| Connector Definition Files | SnowflakeLogs_ConnectorDefinition.json |
| DCR Definition Files | SnowflakeLogs_DCR.json |
| CCF Configuration | SnowflakeLogs_PollingConfig.json |
| CCF Capabilities | APIKey, Paging, POST |
| Microsoft Learn | View on Learn |
The Snowflake data connector provides the capability to ingest Snowflake Login History Logs, Query History Logs, User-Grant Logs, Role-Grant Logs, Load History Logs, Materialized View Refresh History Logs, Roles Logs, Tables Logs, Table Storage Metrics Logs, Users Logs into Microsoft Sentinel using the Snowflake SQL API. Refer to Snowflake SQL API documentation for more information.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
SnowflakeLoad_CL |
✓ | ✓ | ✓ |
SnowflakeLogin_CL |
✓ | ✓ | ✓ |
SnowflakeMaterializedView_CL |
✓ | ✓ | ✓ |
SnowflakeQuery_CL |
✓ | ✓ | ✓ |
SnowflakeRoleGrant_CL |
✓ | ✓ | ✓ |
SnowflakeRoles_CL |
✓ | ✓ | ✓ |
SnowflakeTableStorageMetrics_CL |
✓ | ✓ | ✓ |
SnowflakeTables_CL |
✓ | ✓ | ✓ |
SnowflakeUserGrant_CL |
✓ | ✓ | ✓ |
SnowflakeUsers_CL |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect Snowflake to Microsoft Sentinel
NOTE: To ensure data is presented in separate columns for each field, execute the parser using the Snowflake() function To gather data from Snowflake, you need to provide the following resources
1. Account Identifier
To gather data from Snowflake, you'll need Snowflake Account Identifier.
2. Programmatic Access Token
To gather data from Snowflake, you'll need the Snowflake Programmatic Access Token For detailed instructions on retrieving the Account Identifier and Programmatic Access Token, please refer to the Connector Tutorial. Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:
- Account-Identifier
- Table Name
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Add Account
Add Account
When you click the "Add Account" button in the portal, a configuration form will open. You'll need to provide:
- Snowflake Account Identifier (required): Enter Snowflake Account Identifier
- Snowflake PAT (required): Enter Snowflake PAT
💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊