Snowflake Integration into Cortex XSIAM

[S.Edwin]

Hi Community,
We are planning to integrate Snowflake logs (login and session activity) into Cortex XSIAM. Could you please advise on the recommended integration method to ingest these events into XSIAM?

[susekar]

Hello @S.Edwin ,

Greetings for the day.

The recommended method for ingesting Snowflake logs into Cortex XSIAM is through the native API-based Snowflake Data Source connector available via the Snowflake Content Pack in the Cortex Marketplace.

Configuration Steps:

1. Install Content Pack: Install the Snowflake Content Pack from the Cortex Marketplace.

2. Add Data Source: Navigate to Settings → Data Sources → Add Data Source → Snowflake.

3. Configure Connection: Provide the Snowflake account identifier, database, warehouse, role, and authentication credentials.

4. Configure Fetch Query: Define an SQL query to retrieve the required logs, such as login and session events.

5. Configure Fetch Parameters: Set the initial lookback period, fetch interval, and maximum records per fetch.

6. Test Connectivity: Run the connection test, enable log fetching, and save the integration.
   
   

Key Considerations:

• Ensure the Snowflake role has the required database and warehouse permissions.

• Optimize SQL queries using timestamp filters to avoid unnecessary data retrieval.

• Include mandatory timestamp fields in the query output.

• Adjust fetch limits to prevent timeouts and ingestion delays.

• Ensure outbound network connectivity from the Cortex Gateway to the Snowflake endpoint.
  
  

Conclusion:

The API-based Snowflake Data Source connector is the recommended integration method for Cortex XSIAM. Syslog-based ingestion is not a documented standard approach for Snowflake logs.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar