Panther high experimental python

Snowflake Client IP

Monitor for malicious IPs interacting with Snowflake as part of ongoing cyber threat activity reported May 31st, 2024

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    client_ip = event.get("client_ip", "<NO_IP_FOUND>")
    user_name = event.get("user_name", "<NO USERNAME FOUND>")
    return f"{user_name} accessed Snowflake from {client_ip}"

Field Validations

Loading…

Comments (0)

Loading comments...