Panther medium experimental python

Snowflake Grant to Public Role

Detect additional grants to the public role.

View Source

Detection Logic

def rule(event):
    return event.get("GRANTEE_NAME").lower() == "public"


def title(event):
    return (
        f"{event.get('p_source_label', '<UNKNOWN LOG SOURCE>')}: "
        f"{event.get('GRANTED_BY', '<UNKNOWN ACTOR>')} made changes to the PUBLIC role"
    )

Field Validations

Loading…

Comments (0)

Loading comments...