Panther medium experimental python

Snowflake Configuration Drift

Monitor for configuration drift made by malicious actors as part of ongoing cyber threat activity reported May 31st, 2024

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    user_name = event.get("user_name", "<NO USERNAME FOUND>")
    action = event.get("query_text", "<NO QUERY FOUND>").split(" ")[:2]
    target = " ".join(event.get("query_text", "").split(" ")[-2:])
    return f"{user_name} performed {action} on {target}"

Field Validations

Loading…

Comments (0)

Loading comments...