Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Configure the Snowflake Cloud Collector

Set up the Snowflake Cloud Collector to continuously ingest data from data sources Login History, Others, and Query History.

  1. Before you configure the Snowflake Cloud Collector, ensure that you complete the prerequisites.

  2. Log in to the New-Scale Security Operations Platform with your registered credentials as an administrator.

  3. Navigate to Collectors > Cloud Collectors.

  4. Click New Collector.

  5. Click Snowflake.

  6. Enter the following information for the cloud collector.

    Snowflake1.png

    • NAME – Specify a name for the Cloud Collector instance. For example, Snowflake data warehousing.

    • SNOWFLAKE ACCOUNT NAME – Enter the full Snowflake account name that you obtained while completing prerequisites.

    • USERNAME – Enter the username that you obtained while completing prerequisites.

    • AUTHENTICATION – Select the authentication method — Basic or Key-Pair.

      • Enter the password if you select the basic authentication method.

      • Enter the content of the private key file you obtained while completing prerequisites, for the Key Pair authentication method.

        -----BEGIN PRIVATE KEY-----
**************
**************
**************
.....
-----END PRIVATE KEY-----

    • WAREHOUSE – Select the warehouse that you want the cloud collector to use as the default warehouse while sending queries.

    • DATA SOURCES – Select any or all of these data sources: Login History, Others, Query History, based on your requirement to fetch the data. If you select the data source Others, enter the appropriate value for each discovered table and view. Table name or view name input is required. For example, table name with db_name.schema_name.table/view_name

    • INGEST FROM – Select the time and date from which the collector must start ingesting events. If you leave this field blank and do not provide a threshold, all logs are ingested.

    Note

    • Based on its pricing model, Snowflake charges for storage and compute resources consumed. By default, the Snowflake cloud collector issues a query once every Ten minutes.

    • To reduce the cost of pulling data from multiple datasets, you must minimize the amount of data to be red for each query and ensure that you use the smallest virtual warehouse. For example, if you want to read only a few GB data from a table with 1PB storage capacity, use a very small data warehouse. To improve performance of the connector, use clustering and materialized views.

    • The eviction policy or any policy for deleting the data applies to only a table. The connector reads data only in underlying table format.

    • The Index Timestamp field helps to make the data ordered by the timestamp. The data comes in timestamp order. As a user, no action is required from you to maximize connector performance and minimize cost. Snowflake uses pruning to read the data that is required to satisfy the query every time a timestamp range is used as a filter. If the data comes in random order, use Snowflake clustering to ensure that the data stays ordered for other log fields that are used as filters.

  7. (Optional) SITE – Select an existing site or to create a new site with a unique ID, click manage your sites. Adding a site name helps you to ensure efficient management of environments with overlapping IP addresses.

    By entering a site name, you associate the logs with a specific independent site. A sitename metadata field is automatically added to all the events that are going to be ingested via this collector. For more information about Site Management, see Define a Unique Site Name.

  8. (Optional) TIMEZONE – Select a time zone applicable to you for accurate detections and event monitoring.

    By entering a time zone, you override the default log time zone. A timezone metadata field is automatically added to all events ingested through this collector.

    Timezone_sitename_site_management_1.png

  9. To confirm that the New-Scale Security Operations Platform communicates with the service, click Test Connection. 

  10. Click Install.

    AWS_S3_2.png

    A confirmation message informs you that the new Cloud Collector is created.