Panther low experimental python

Snowflake User Daily Query Volume Spike

Returns instances where a user's cumulative daily query volume is much larger than normal. Could indicate exfiltration attempts.

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    username = event.get("user_name", "<UNKNOWN USER>")
    source = event.get("p_source_label", "<UNKNOWN SOURCE>")
    return f"{source}: Abnormally large query volume from user {username}"

Field Validations

Loading…

Comments (0)

Loading comments...