snowflake_user_created_query.yml

AnalysisType: scheduled_query
QueryName: Query.Snowflake.UserCreated
Enabled: false
Description: >
  Monitor for new users.
AthenaQuery: >
  /* athena query not supported */
  SELECT count(1)
SnowflakeQuery: >
  --return create user events

  --this was adapted from a Security Feature Checklist query

  SELECT
    end_time,
    query_type,
    query_text,
    user_name,
    role_name
  FROM snowflake.account_usage.query_history
    WHERE
      p_occurs_since('24 h',, start_time)
      AND execution_status = 'SUCCESS'
      AND query_type = 'CREATE_USER'
      AND query_text ILIKE '%create%user%'
  ORDER BY end_time desc
Schedule:
  CronExpression: '0 6 * * *'
  TimeoutMinutes: 1