Panther medium experimental python

Snowflake Account Admin Granted

Detect when account admin is granted.

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    target = " ".join(event.get("query_text", "").split(" ")[-2:])
    return f"Snowflake AccountAdmin granted to {target}"

Field Validations

Loading…

Comments (0)

Loading comments...