topic Snowflake Integration into Cortex XSIAM in Cortex XSIAM Discussions https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/snowflake-integration-into-cortex-xsiam/m-p/1266652#M492 <DIV>Hi Community, <BR />We are planning to integrate Snowflake logs (login and session activity) into Cortex XSIAM. Could you please advise on the recommended integration method to ingest these events into XSIAM?</DIV> Wed, 21 Oct 2026 12:23:32 GMT S.Edwin 2026-10-21T12:23:32Z Snowflake Integration into Cortex XSIAM https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/snowflake-integration-into-cortex-xsiam/m-p/1266652#M492 <DIV>Hi Community, <BR />We are planning to integrate Snowflake logs (login and session activity) into Cortex XSIAM. Could you please advise on the recommended integration method to ingest these events into XSIAM?</DIV> Wed, 21 Oct 2026 12:23:32 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/snowflake-integration-into-cortex-xsiam/m-p/1266652#M492 S.Edwin 2026-10-21T12:23:32Z Re: Snowflake Integration into Cortex XSIAM https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/snowflake-integration-into-cortex-xsiam/m-p/1267688#M493 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/143252387">@S.Edwin</a>&nbsp;,</P> <P>&nbsp;</P> <P>Greetings for the day.</P> <P>&nbsp;</P> <DIV class="xjbqb8w xbs2zpe x1jchvi3 x1r771fr xh8yej3 x14nib4c x1ep1s60 x193iq5w xeuugli x1n2onr6"> <DIV> <DIV class="xh8yej3 x1ghz6dp x193iq5w xeuugli x1mzt3pk x5x58ly xhkq44x xvyh8ph xwxxt6x x1ewz1rw x1r0vnzf x1ux7cnd xp43mbd xtbxs66 xak2u8z x1yc453h x16sz92x" data-assistant-markdown-root="" data-assistant-markdown=""> <DIV aria-busy="false"> <DIV> <SECTION class="xvmahel xlh3980 x78zum5 xdt5ytf x1qjc9v5 x1gpaknb x1jchvi3 xo1l8bm x12oo3zp x14nib4c x1fj9vlw x1mzt3pk x9f619 xeuugli x19aimcq x14rh7hd" dir="auto" aria-label="DIL content"> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x1wwbdsi x86bw1a x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd" data-d-component="text"><SPAN data-d-streaming-word="">The</SPAN> <SPAN data-d-streaming-word="">recommended</SPAN> <SPAN data-d-streaming-word="">method</SPAN> <SPAN data-d-streaming-word="">for</SPAN> <SPAN data-d-streaming-word="">ingesting</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">logs</SPAN> <SPAN data-d-streaming-word="">into</SPAN> <SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Cortex</SPAN> <SPAN data-d-streaming-word="">XSIAM</SPAN></SPAN> <SPAN data-d-streaming-word="">is</SPAN> <SPAN data-d-streaming-word="">through</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">native</SPAN> <SPAN data-d-streaming-word="">API-based</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">Data</SPAN> <SPAN data-d-streaming-word="">Source</SPAN> <SPAN data-d-streaming-word="">connector</SPAN> <SPAN data-d-streaming-word="">available</SPAN> <SPAN data-d-streaming-word="">via</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">Content</SPAN> <SPAN data-d-streaming-word="">Pack</SPAN> <SPAN data-d-streaming-word="">in</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Cortex</SPAN> <SPAN data-d-streaming-word="">Marketplace.<BR /><BR /></SPAN></P> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x1wwbdsi x86bw1a x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd" data-d-component="text"><STRONG><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text">Configuration Steps:</SPAN></STRONG></P> <OL class="x78zum5 xdt5ytf xeuugli x1717udv x1ghz6dp x11v4sto x10of0ok xe8uvvx xy09zc5 x1ovvlb x1kw3rcc x104jwf5 x1lziwak x15472z4 x43c9pm xld8u84 x3yw8vx" role="list" data-d-marker-layout="native" data-d-marker="number" data-d-component="list"> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x77z7ai x1sjuu80 xgqnvjb xdj266r x15eiy0f x1lziwak x15472z4 xtcx8v3 xzngokm x2qjak5" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Install</SPAN> <SPAN data-d-streaming-word="">Content</SPAN> <SPAN data-d-streaming-word="">Pack:</SPAN></SPAN> <SPAN data-d-streaming-word="">Install</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">Content</SPAN> <SPAN data-d-streaming-word="">Pack</SPAN> <SPAN data-d-streaming-word="">from</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Cortex</SPAN> <SPAN data-d-streaming-word="">Marketplace.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x77z7ai x1sjuu80 xgqnvjb xdj266r x15eiy0f x1lziwak x15472z4 xtcx8v3 xzngokm x2qjak5" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Add</SPAN> <SPAN data-d-streaming-word="">Data</SPAN> <SPAN data-d-streaming-word="">Source:</SPAN></SPAN> <SPAN data-d-streaming-word="">Navigate</SPAN> <SPAN data-d-streaming-word="">to</SPAN> <SPAN data-d-streaming-word="">Settings</SPAN> <SPAN data-d-streaming-word="">→</SPAN> <SPAN data-d-streaming-word="">Data</SPAN> <SPAN data-d-streaming-word="">Sources</SPAN> <SPAN data-d-streaming-word="">→</SPAN> <SPAN data-d-streaming-word="">Add</SPAN> <SPAN data-d-streaming-word="">Data</SPAN> <SPAN data-d-streaming-word="">Source</SPAN> <SPAN data-d-streaming-word="">→</SPAN> <SPAN data-d-streaming-word="">Snowflake.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x77z7ai x1sjuu80 xgqnvjb xdj266r x15eiy0f x1lziwak x15472z4 xtcx8v3 xzngokm x2qjak5" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Configure</SPAN> <SPAN data-d-streaming-word="">Connection:</SPAN></SPAN> <SPAN data-d-streaming-word="">Provide</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">account</SPAN> <SPAN data-d-streaming-word="">identifier,</SPAN> <SPAN data-d-streaming-word="">database,</SPAN> <SPAN data-d-streaming-word="">warehouse,</SPAN> <SPAN data-d-streaming-word="">role,</SPAN> <SPAN data-d-streaming-word="">and</SPAN> <SPAN data-d-streaming-word="">authentication</SPAN> <SPAN data-d-streaming-word="">credentials.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x77z7ai x1sjuu80 xgqnvjb xdj266r x15eiy0f x1lziwak x15472z4 xtcx8v3 xzngokm x2qjak5" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Configure</SPAN> <SPAN data-d-streaming-word="">Fetch</SPAN> <SPAN data-d-streaming-word="">Query:</SPAN></SPAN> <SPAN data-d-streaming-word="">Define</SPAN> <SPAN data-d-streaming-word="">an</SPAN> <SPAN data-d-streaming-word="">SQL</SPAN> <SPAN data-d-streaming-word="">query</SPAN> <SPAN data-d-streaming-word="">to</SPAN> <SPAN data-d-streaming-word="">retrieve</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">required</SPAN> <SPAN data-d-streaming-word="">logs,</SPAN> <SPAN data-d-streaming-word="">such</SPAN> <SPAN data-d-streaming-word="">as</SPAN> <SPAN data-d-streaming-word="">login</SPAN> <SPAN data-d-streaming-word="">and</SPAN> <SPAN data-d-streaming-word="">session</SPAN> <SPAN data-d-streaming-word="">events.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x77z7ai x1sjuu80 xgqnvjb xdj266r x15eiy0f x1lziwak x15472z4 xtcx8v3 xzngokm x2qjak5" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Configure</SPAN> <SPAN data-d-streaming-word="">Fetch</SPAN> <SPAN data-d-streaming-word="">Parameters:</SPAN></SPAN> <SPAN data-d-streaming-word="">Set</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">initial</SPAN> <SPAN data-d-streaming-word="">lookback</SPAN> <SPAN data-d-streaming-word="">period,</SPAN> <SPAN data-d-streaming-word="">fetch</SPAN> <SPAN data-d-streaming-word="">interval,</SPAN> <SPAN data-d-streaming-word="">and</SPAN> <SPAN data-d-streaming-word="">maximum</SPAN> <SPAN data-d-streaming-word="">records</SPAN> <SPAN data-d-streaming-word="">per</SPAN> <SPAN data-d-streaming-word="">fetch.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x77z7ai x1sjuu80 xgqnvjb xdj266r x15eiy0f x1lziwak x15472z4 xtcx8v3 xzngokm x2qjak5" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text"><SPAN data-d-streaming-word="">Test</SPAN> <SPAN data-d-streaming-word="">Connectivity:</SPAN></SPAN> <SPAN data-d-streaming-word="">Run</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">connection</SPAN> <SPAN data-d-streaming-word="">test,</SPAN> <SPAN data-d-streaming-word="">enable</SPAN> <SPAN data-d-streaming-word="">log</SPAN> <SPAN data-d-streaming-word="">fetching,</SPAN> <SPAN data-d-streaming-word="">and</SPAN> <SPAN data-d-streaming-word="">save</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">integration.<BR /><BR /></SPAN></P> </DIV> </DIV> </LI> </OL> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x1wwbdsi x86bw1a x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd" data-d-component="text"><STRONG><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text">Key Considerations:</SPAN></STRONG></P> <UL class="x78zum5 xdt5ytf xeuugli x1717udv x1ghz6dp x11v4sto x10of0ok xe8uvvx xy09zc5 x1ovvlb x1kw3rcc x104jwf5 x1lziwak x15472z4 x43c9pm xld8u84 xtaz4m5" role="list" data-d-marker-layout="native" data-d-marker="bullet" data-d-component="list"> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x1sjuu80 xgqnvjb x1n7kpnw xdj266r x15eiy0f x15472z4 xtcx8v3 x1xf89zq x1znate" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN data-d-streaming-word="">Ensure</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">role</SPAN> <SPAN data-d-streaming-word="">has</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">required</SPAN> <SPAN data-d-streaming-word="">database</SPAN> <SPAN data-d-streaming-word="">and</SPAN> <SPAN data-d-streaming-word="">warehouse</SPAN> <SPAN data-d-streaming-word="">permissions.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x1sjuu80 xgqnvjb x1n7kpnw xdj266r x15eiy0f x15472z4 xtcx8v3 x1xf89zq x1znate" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN data-d-streaming-word="">Optimize</SPAN> <SPAN data-d-streaming-word="">SQL</SPAN> <SPAN data-d-streaming-word="">queries</SPAN> <SPAN data-d-streaming-word="">using</SPAN> <SPAN data-d-streaming-word="">timestamp</SPAN> <SPAN data-d-streaming-word="">filters</SPAN> <SPAN data-d-streaming-word="">to</SPAN> <SPAN data-d-streaming-word="">avoid</SPAN> <SPAN data-d-streaming-word="">unnecessary</SPAN> <SPAN data-d-streaming-word="">data</SPAN> <SPAN data-d-streaming-word="">retrieval.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x1sjuu80 xgqnvjb x1n7kpnw xdj266r x15eiy0f x15472z4 xtcx8v3 x1xf89zq x1znate" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN data-d-streaming-word="">Include</SPAN> <SPAN data-d-streaming-word="">mandatory</SPAN> <SPAN data-d-streaming-word="">timestamp</SPAN> <SPAN data-d-streaming-word="">fields</SPAN> <SPAN data-d-streaming-word="">in</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">query</SPAN> <SPAN data-d-streaming-word="">output.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x1sjuu80 xgqnvjb x1n7kpnw xdj266r x15eiy0f x15472z4 xtcx8v3 x1xf89zq x1znate" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN data-d-streaming-word="">Adjust</SPAN> <SPAN data-d-streaming-word="">fetch</SPAN> <SPAN data-d-streaming-word="">limits</SPAN> <SPAN data-d-streaming-word="">to</SPAN> <SPAN data-d-streaming-word="">prevent</SPAN> <SPAN data-d-streaming-word="">timeouts</SPAN> <SPAN data-d-streaming-word="">and</SPAN> <SPAN data-d-streaming-word="">ingestion</SPAN> <SPAN data-d-streaming-word="">delays.</SPAN></P> </DIV> </DIV> </LI> <LI class="x1cy8zhl xeuugli x167g77z x1et0kgd x3olw3b x1sjuu80 xgqnvjb x1n7kpnw xdj266r x15eiy0f x15472z4 xtcx8v3 x1xf89zq x1znate" data-d-marker-layout="native" data-d-component="list-item"> <DIV class="x78zum5 xdt5ytf x12lumcd xeuugli"> <DIV> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd xg07evd" data-d-component="text"><SPAN data-d-streaming-word="">Ensure</SPAN> <SPAN data-d-streaming-word="">outbound</SPAN> <SPAN data-d-streaming-word="">network</SPAN> <SPAN data-d-streaming-word="">connectivity</SPAN> <SPAN data-d-streaming-word="">from</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Cortex</SPAN> <SPAN data-d-streaming-word="">Gateway</SPAN> <SPAN data-d-streaming-word="">to</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">endpoint.<BR /><BR /></SPAN></P> </DIV> </DIV> </LI> </UL> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x1wwbdsi x86bw1a x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd" data-d-component="text"><STRONG><SPAN class="xt0psk2 x1ghz6dp x1717udv x1wty727 x4gjf66 x15eiy0f x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1s688f x14rh7hd xdj266r" data-d-inline="" data-d-component="text">Conclusion:</SPAN></STRONG></P> <P class="x1ghz6dp x1717udv x1wty727 x1pd3egz x4gjf66 x1wwbdsi x86bw1a x1lziwak x15472z4 x1qlqyl8 x15bjb6t x1lliihq x14rh7hd" data-d-component="text"><SPAN data-d-streaming-word="">The</SPAN> <SPAN data-d-streaming-word="">API-based</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">Data</SPAN> <SPAN data-d-streaming-word="">Source</SPAN> <SPAN data-d-streaming-word="">connector</SPAN> <SPAN data-d-streaming-word="">is</SPAN> <SPAN data-d-streaming-word="">the</SPAN> <SPAN data-d-streaming-word="">recommended</SPAN> <SPAN data-d-streaming-word="">integration</SPAN> <SPAN data-d-streaming-word="">method</SPAN> <SPAN data-d-streaming-word="">for</SPAN> <SPAN data-d-streaming-word="">Cortex</SPAN> <SPAN data-d-streaming-word="">XSIAM.</SPAN> <SPAN data-d-streaming-word="">Syslog-based</SPAN> <SPAN data-d-streaming-word="">ingestion</SPAN> <SPAN data-d-streaming-word="">is</SPAN> <SPAN data-d-streaming-word="">not</SPAN> <SPAN data-d-streaming-word="">a</SPAN> <SPAN data-d-streaming-word="">documented</SPAN> <SPAN data-d-streaming-word="">standard</SPAN> <SPAN data-d-streaming-word="">approach</SPAN> <SPAN data-d-streaming-word="">for</SPAN> <SPAN data-d-streaming-word="">Snowflake</SPAN> <SPAN data-d-streaming-word="">logs.</SPAN></P> </SECTION> </DIV> <DIV role="status">&nbsp;</DIV> </DIV> </DIV> </DIV> </DIV> <P>If you feel this has answered your query, please let us know by clicking&nbsp;<STRONG>like&nbsp;</STRONG>and on&nbsp;<STRONG>"mark this as a Solution"</STRONG>.</P> <P>&nbsp;</P> <P>Thanks &amp; Regards,<BR />S. Subashkar Sekar</P> Wed, 04 Nov 2026 13:07:53 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/snowflake-integration-into-cortex-xsiam/m-p/1267688#M493 susekar 2026-11-04T13:07:53Z