Snowflake

The Snowflake connector enables automated interactions with the Snowflake Data Cloud, allowing users to perform SQL queries and manage data within their security operations workflows.

Snowflake is a cloud-based data warehousing platform that enables scalable, secure, and easy-to-use data storage and analytics. The Snowflake connector for Swimlane Turbine allows users to execute SQL queries, insert data, and run stored procedures directly within the Swimlane platform. This integration empowers security teams to automate data analysis and response workflows, enhancing their ability to quickly access and act upon security data. By leveraging Snowflake's powerful data processing capabilities, users can streamline their security operations and gain valuable insights from their data without the need for complex coding.

Prerequisites

To utilize the Snowflake connector with Swimlane Turbine, ensure you have the following prerequisites:

Basic Authentication with these parameters:

Account: The unique identifier for your Snowflake account.

Username: Your Snowflake user login name.

Password: Your Snowflake account password.

Key Pair Authentication with these parameters:

RSA key Base64: Your base64-encoded RSA private key.

RSA Password: The passphrase for your RSA private key, if applicable.

Account: The unique identifier for your Snowflake account.

Username: Your Snowflake user login name.

Capabilities

This connector provides the following capabilities:

Run Read-Only Query

Run Modification Query

Run Stored Procedure

Action Setup

The action "Run Query" allows inputs to be passed as wild cards. Any "%s" present will be replaced, in order, with supplied "Parameters".

Example:

Query = "SELECT id FROM Person where id = %s or id < %s" Parameters = ["10","20"]

The following query will be executed:

"SELECT id FROM Person where id = 10 or id < 20"

When executing a Stored Procedure, it is important to add the parenthesis to the end of the procedure name.

Example:

sp_get_history() or sp_get_history(%s, %s)

Configurations

Snowflake Basic Auth

Authenticating using Username and Password.

Configuration Parameters

Parameter	Description	Type	Required
account	Account name without the @snowflakecomputing.com	string	Required
user	Username to connect to the Database.	string	Required
password	Password.	string	Required
database	Name of the Database.	string	Optional
warehouse	Name of the Database.	string	Optional
schema	Name of the Database.	string	Optional
role	Role in use on Snowflake.	string	Optional
login_timeout	Login timeout in seconds. Used while authenticating.	number	Optional
network_timeout	Network timeout. Used for general purpose	number	Optional
proxy_host	Proxy host.	string	Optional
proxy_port	Proxy port.	number	Optional
proxy_user	Proxy user.	string	Optional
proxy_password	Proxy Password	string	Optional

Snowflake Key Pair Auth

Authenticating using Username and Password.

Configuration Parameters

Parameter	Description	Type	Required
private_key_file_base64	RSA key in Base64 format.	string	Required
private_key_file_pwd	rsa password.	string	Required
account	Account name without the @snowflakecomputing.com	string	Required
user	Username to connect to the Database.	string	Required
password	Password.	string	Optional
database	Name of the Database.	string	Optional
warehouse	Name of the Database.	string	Optional
schema	Name of the Database.	string	Optional
role	Role in use on Snowflake.	string	Optional
login_timeout	Login timeout in seconds. Used while authenticating.	number	Optional
network_timeout	Network timeout. Used for general purpose	number	Optional
proxy_host	Proxy host.	string	Optional
proxy_port	Proxy port.	number	Optional
proxy_user	Proxy user.	string	Optional
proxy_password	Proxy Password	string	Optional

Actions

Run Modification Query

Executes a non-returning modification query, such as INSERT, on the Snowflake database.

Input

Argument Name	Type	Required	Description
query	string	Required	Query - Using parameters is acceptable ('select * from foo where id = %s or id = %s'). Parameters need to be supplied through the parameter input in order.
parameters	array	Optional	A list of parameters. Should be in order.

Input Example

{"parameters":["idparam1","idparam2"],"query":"INSERT INTO example1 VALUES (2, 'Bob');"}

Output

Parameter	Type	Description
result	string	Result of the operation
query	string	Output field: query
row_count	number	Count value

Output Example

{"result":"Success","query":"INSERT INTO example1 VALUES (2, 'Bob');","row_count":1}

Run Read-Only Query

Executes a specified SQL query in Snowflake and returns the results, suitable for information retrieval operations like SELECT.

Input

Argument Name	Type	Required	Description
query	string	Required	Query - Using parameters is acceptable ('select * from foo where id = %s or id = %s'). Parameters need to be supplied through the parameter input in order.
parameters	array	Optional	A list of parameters. Should be in order.
to_csv	boolean	Optional	When True, returns a CSV as an attachment.

Input Example

{"parameters":["idparam1","idparam2"],"query":"SELECT TABLE_NAME FROM DBA_TABLE","to_csv":false}

Output

Parameter	Type	Description
data	array	Response data
query	string	Output field: query
row_count	number	Count value
columns	array	Output field: columns
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"data":[],"query":"SELECT * FROM CUSTOMER LIMIT 10;","row_count":10,"columns":[]}

Run Stored Procedure

Executes a specified stored procedure in Snowflake and retrieves the resulting data.

Input

Argument Name	Type	Required	Description
stored_procedure	string	Required	Name of the Stored Procedure to Run.
parameters	array	Optional	A list of parameters. Should be in order.
to_csv	boolean	Optional	When True, returns a CSV as an attachment.

Input Example

{"parameters":["idparam1","idparam2"],"stored_procedure":"sp_getPerson(%s, %s) or sp_getPerson()","to_csv":false}

Output

Parameter	Type	Description
data	array	Response data
query	string	Output field: query
row_count	number	Count value
columns	array	Output field: columns
file	object	Attachments
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"data":[],"query":"SELECT * FROM CUSTOMER LIMIT 10;","row_count":10,"columns":[]}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT