Panther low experimental python

Suspicious Snowflake Sessions - Unusual Application

Detects unusual (non-common) applications and client characteristics that have been used to connect to a Snowflake account

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    return f"{event.get('p_source_label', '<UNKNOWN SOURCE>')}: Suspicious Application Session"


def dedup(event):
    return "-".join(
        (
            event.get("client_application", "<UNKNOWN APP>"),
            event.get("client_os", "<UNKNOWN OS>"),
            event.get("client_os_version", "<UNKNOWN VERSION>"),
        )
    )

Field Validations

Loading…

Comments (0)

Loading comments...